auth[.]booking-comarab-dubai-shopping[.]webflow[.]io

Analysis of the domain auth.booking-comarab-dubai-shopping.webflow.io indicates that it is being leveraged for credential harvesting. The domain was registered on June 12, 2026 through the Webflow platform, a service frequently abused for short‑lived malicious sites. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, suggesting that at least a minority of detection engines recognize malicious behavior.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the assessment that it is being used for phishing‑related activities. No public evidence has been provided regarding its IP address, hosting ASN, SSL certificate details, HTTP response codes, Safe Browsing status, Open Threat Exchange references, or page title, so those attributes remain unverified at this time. Defenders should treat any communications originating from or referencing this domain as hostile.

Recommended actions include adding the full hostname to web filtering and intrusion detection rule sets, monitoring outbound traffic for connections to the Webflow hosting range, and updating endpoint protection signatures to incorporate the two vendor detections reported by VirusTotal. Continuous re‑evaluation is advised as additional intelligence, such as URL‑based payloads or sinkhole data, becomes available.