pay[.]aebooking-com-dubai-shopping[.]webflow[.]io

Analysis indicates that the domain pay.aebooking-com-dubai-shopping.webflow.io was registered on June 12, 2026 through Webflow’s hosting platform. The domain resolves to IP address 104.18.36.248, an address associated with the Cloudflare network that is commonly used by Webflow‑hosted sites. VirusTotal has recorded 2 of 91 security vendors flagging the domain as malicious, providing modest but concrete detection evidence. The domain appears on a single public blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has identified it as a threat.

No additional metadata such as SSL certificate details, HTTP response codes, page title, or content analysis is presently available, so the exact phishing payload, credential‑harvesting technique, and any targeted brand remain unknown. The brief lifespan—created only weeks before the report date—matches the fast‑deployment pattern observed in opportunistic phishing campaigns. Because the sub‑domain lives under the legitimate‑looking Webflow.io namespace, it benefits from a default TLS certificate, which can increase user trust and reduce suspicion. Defenders should add both the fully qualified domain name and its resolved IP address to deny‑list rules at DNS, proxy, and firewall layers.

Continuous monitoring of DNS queries for this domain and periodic re‑scans with multi‑engine services are recommended to capture any content changes or additional detections. Incident response teams encountering communications that reference this URL should treat any provided credentials or personal data as potentially compromised and isolate affected accounts. Ongoing intelligence gathering is advised to determine the site’s actual content and to update mitigation actions accordingly.