staging[.]dubai-bookingcom[.]webflow[.]io

Analysis of staging.dubai-bookingcom.webflow.io indicates that the domain was registered on June 12 2026 through the Webflow hosting platform. DNS resolution points to the address 172.64.151.8, which belongs to the infrastructure used by Webflow customers. The domain is listed on a single security blocklist and has been flagged by PhishDestroy as an active phishing source. VirusTotal reports that the domain was scanned by 91 anti‑malware engines; none of the engines raised a detection at the time of analysis, but the absence of a detection does not constitute a safety assurance.

No public Safe Browsing, OTX, or other reputation feeds have reported the domain, and no SSL/TLS certificate details or HTTP status codes are available in the current intelligence set. The page title and content have not been captured, leaving the visual content and targeted brand unconfirmed. Consequently, the confidence level regarding the exact phishing lure is limited to the generic classification supplied. Defenders should treat the domain as hostile, enforce DNS‑level blocking, and ensure that any outbound connections to 172.64.151.8 are denied or redirected to a sinkhole.

Continuous monitoring of Webflow‑hosted subdomains for similar creation dates or patterns is recommended, as is periodic re‑scanning with VirusTotal and other sandbox services to capture any future payloads. Organizations using Webflow for legitimate services should verify that this particular sub‑domain does not appear in their asset inventory. Incident response teams should collect packet captures if the domain is accessed, and update internal blocklists accordingly.