staging[.]bookingcomdubaithingstodoes[.]webflow[.]io

Analysis of the domain staging.bookingcomdubaithingstodoes.webflow.io shows that it was created on June 12, 2026 and registered through the Webflow platform, a legitimate website‑building service that provides shared hosting for custom subdomains. The domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy feed, indicating that at least one operational anti‑phishing system has identified it as malicious. VirusTotal scans report that two of ninety‑one security vendors flagged the domain, which reinforces the suspicion that the site is being used for malicious purposes despite the relatively low detection count. No additional metadata such as IP address, ASN, country, SSL certificate details, HTTP response codes, or page title is available in the supplied intelligence, and the page content has not been publicly analysed.

Consequently, the precise nature of the phishing payload, the targeted brand, and the user‑experience presented on the site remain uncertain. Defenders should treat the domain as a high‑confidence indicator of a phishing campaign and incorporate it into DNS and proxy filtering rules to block outbound connections. Network logs should be examined for any recent requests to the Webflow subdomain, especially from internal hosts that may have accessed it after the creation date.

Because the domain leverages a reputable hosting provider, additional scrutiny of traffic to other Webflow‑hosted subdomains may be warranted to detect potential reuse of the same infrastructure. Continuous monitoring of threat‑intel feeds for updates on the domain, as well as periodic re‑scans on VirusTotal or similar platforms, will help confirm whether the detection count changes or new indicators emerge.