booking-comae-dubai-restaurants[.]webflow[.]io

The domain booking-comae-dubai-restaurants.webflow.io was registered on June 12 2026 via the Webflow platform and currently resolves to the IP address 104.18.36.248. Within a month of creation it has been added to a single security blocklist and is actively listed by the PhishDestroy feed. VirusTotal analysis shows that two of ninety‑one scanning engines have raised detections against the domain, indicating that at least a minority of scanners consider it malicious.

The hosting provider is Webflow, which supplies shared TLS certificates for sub‑domains; no custom SSL details are available beyond the default certificate presented by the service. No public page title, brand reference, or malicious payload has been disclosed, so the exact content of the site remains unverified. However, the combination of recent creation, association with a known phishing feed, and multiple vendor flags meets the criteria for an elevated‑risk phishing indicator.

Defenders should treat any traffic to this host as hostile. Recommended actions include adding the domain to outbound web filtering rules, blocking the IP 104.18.36.248 at the network perimeter, and monitoring for any future DNS or TLS certificate changes. Continuous re‑scanning on VirusTotal and inclusion in internal threat‑intel feeds will help maintain visibility as the infrastructure evolves.