booking--comdubaii[.]webflow[.]io

On July 29, 2026, analysis of the domain booking--comdubaii.webflow.io indicates that the site is actively being used for phishing. The domain was registered through Webflow on June 12, 2026 and resolves to the IPv4 address 172.64.151.8. It appears on a single security blocklist and is explicitly listed as blocked by PhishDestroy. A VirusTotal scan returned a detection ratio of 2 out of 91 security vendors, confirming that at least two independent scanners have identified malicious characteristics. No publicly available information about SSL/TLS configuration, HTTP response codes, page title, or additional content has been observed, suggesting limited exposure or that the site may be serving targeted payloads only to specific users.

The infrastructure choice—hosting on a reputable SaaS platform—allows the attacker to leverage Webflow’s trusted domain reputation while obscuring the true malicious intent. The combination of blocklist inclusion, vendor detections, and the recent creation date points to a non‑trivial risk profile. Defenders should immediately add both the fully qualified domain name and its resolved IP address to deny‑list or firewall rules, monitor DNS query logs for lookups to this host, and consider network‑level blocking of traffic to 172.64.151.8. Incident response teams should review endpoint and proxy logs for any connections to the domain or IP, and correlate those events with user reports of credential‑harvesting attempts.

Because the site’s content has not been publicly harvested, further investigation using safe‑browsing APIs or sandboxed retrieval is recommended to capture the exact phishing page, extract any embedded URLs, form fields, or malicious scripts, and enrich indicator sets. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to track changes in detection status.