booking-comdubai[.]webflow[.]io[.]webflow[.]io

The domain booking-comdubai.webflow.io.webflow.io is currently classified as an active generic phishing site with an elevated risk rating. Analysis of public threat‑intelligence sources shows that VirusTotal has recorded three detections out of ninety‑one submitted security engines, indicating that a minority of scanners have identified malicious behavior associated with the host. The same domain is listed on one external blocklist and is explicitly blocked by the PhishDestroy filtering service, further confirming its presence on known phishing watch lists. The domain was registered through the Webflow platform on 12 June 2026, and the registrar information points to a managed DNS service that can be leveraged for short‑lived malicious pages.

No additional registrant metadata is publicly disclosed beyond the registrar identifier. At present, public scans have not revealed the underlying IP address, hosting ASN, geographic location, or SSL certificate details for the host. Likewise, automated crawlers have not captured the page title, brand references, or any payload characteristics, so the specific lure or credential‑harvesting technique employed by the site remains unverified. The lack of observed HTTP response codes or content hashes prevents a deeper behavioral assessment.

Defenders should proactively block the fully qualified domain name in network perimeter and endpoint URL filtering solutions. Because the domain resolves through Webflow’s CDN, any rule that restricts wildcard subdomains under webflow.io may mitigate future variants that mimic the same naming pattern. Security operations teams are advised to monitor VirusTotal and other multi‑engine scanners for any change in detection count, and to incorporate the domain into threat‑intelligence feeds consumed by SIEM correlation rules. Continuous observation of DNS queries for the domain can provide early indicators of active exploitation attempts.