smtp[.]booking-comsdubai[.]webflow[.]io

Analysis indicates that smtp.booking-comsdubai.webflow.io was registered on June 12 2026 via the Webflow platform. The domain resolves to the Cloudflare address 104.18.36.248 and is currently listed on a single security blocklist. VirusTotal scans show that 2 of 91 antivirus engines have flagged the domain, and the phishing‑specific feed PhishDestroy has already blocked it. The threat is categorized as generic phishing with an elevated risk rating and remains active as of the report date, July 29 2026.

No public information is available regarding the site’s SSL certificate, HTTP response codes, page title, or any additional reputation scores from Google Safe Browsing, OTX, or similar services. Consequently, the full malicious payload or credential‑harvesting mechanism cannot be confirmed at this time. Defenders should immediately add the domain to outbound filtering rules and DNS blocklists, monitor for any connections to the hosting IP 104.18.36.248, and consider applying sinkhole redirects for traffic destined to the address.

Continuous re‑scanning with VirusTotal and other multi‑engine platforms is advised to capture any changes in detection rates. Organizations that use Webflow‑based hosting should review their allowed‑list policies, as the registrar appears to be a legitimate service repurposed for malicious use. Ongoing threat‑intel feeds should be consulted for updates, and any observed exploitation attempts should be logged and reported to relevant sharing communities.