backend[.]bookkingcoom--dubai[.]webflow[.]io

backend.bookkingcoom--dubai.webflow.io was registered on June 12, 2026 through the Webflow hosting service. The domain is currently active and resolves to a Webflow‑hosted site, indicating the attacker is leveraging a legitimate SaaS platform to obtain a trusted TLS certificate and reduce hosting costs. VirusTotal reports that three of ninety‑one scanning engines flagged the domain as malicious, which aligns with its appearance on a single public blocklist. The blocklist entry and the independent PhishDestroy block confirm that security communities have observed phishing‑related activity originating from this host.

No public information is available regarding the underlying IP address, ASN, or geographic location, and the page title has not been disclosed in the intelligence feed. Consequently, the precise content of the site cannot be verified, but the classification as a generic phishing site is supported by the vendor detections and blocklist inclusion. Defenders should add the fully qualified domain name to DNS‑based deny lists and configure web proxies to drop HTTP/HTTPS requests to the host. Network‑level filters that reference the known blocklist entry can also be employed.

Continuous monitoring of VirusTotal and other reputation services is advised, as additional detections may appear if the site expands its campaign. Because the domain uses a reputable hosting provider, traditional IP‑based blocking may be ineffective; domain‑level controls remain the most reliable mitigation. Organizations should remain vigilant for credential‑harvesting attempts that reference the “bookkingcoom” pattern, especially in communications purporting to originate from Dubai‑related services.