booking-comuae-dubai-things-to-do[.]webflow[.]io

Analysis of booking-comuae-dubai-things-to-do.webflow.io indicates that the domain is actively used for a generic phishing campaign. The site was registered through Webflow, a popular website‑building platform, and resolves to the IP address 104.18.36.248, which is associated with a large content‑delivery network. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed has identified it as malicious.

VirusTotal scans show that five of ninety‑one antivirus and URL‑reputation engines have flagged the domain, providing additional corroboration of its malicious nature. No public Safe Browsing, OTX, or other reputation data were supplied, and the page title or content has not been disclosed, so the exact visual or credential‑harvesting tactics remain unknown. Defenders should treat the domain as high‑confidence malicious: add the fully qualified domain name to URL filtering and DNS block policies, consider blocking the resolving IP 104.18.36.248 at the network perimeter, and monitor for any outbound connections to that address.

Because the hosting provider is Webflow, organizations using Webflow‑based sites should enforce strict outbound controls to prevent data exfiltration to this infrastructure. Continuous re‑evaluation is advised as additional detection vendors may update their verdicts and further intelligence, such as page content or SSL certificate details, could become available.