bestdubaibookings[.]webflow[.]io

Analysis of bestdubaibookings.webflow.io indicates an active credential-phishing domain registered through Webflow and resolving to IP 104.18.36.248. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans report five detections from 91 security vendors, confirming elevated risk classification.

The domain's infrastructure is hosted on Webflow's platform, which is commonly used for both legitimate and malicious sites, complicating attribution without further behavioral analysis. No specific brand target or phishing kit has been identified in available intelligence, and the exact content of the site remains unanalyzed. The domain's name suggests a focus on travel or booking services, but this cannot be confirmed without additional evidence.

Defenders should treat this domain as a confirmed phishing threat and implement blocking at the DNS or proxy level. Network monitoring should prioritize connections to 104.18.36.248, particularly from endpoints handling sensitive credentials or financial data. Further investigation into associated email campaigns or redirect chains is recommended to determine the full scope of this phishing operation.