booking-comaeu-dubai-shopping[.]webflow[.]io

The domain booking-comaeu-dubai-shopping.webflow.io was observed resolving to the IP address 104.18.36.248, which is owned by the Cloudflare network and commonly used for content delivery. Registration metadata indicates the domain was created through the Webflow hosting service, a platform that allows users to publish sites without direct server control. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable sinkhole has identified it as malicious. VirusTotal analysis shows that two out of ninety‑one scanned security engines have flagged the domain, suggesting that a minority of scanners have detected suspicious characteristics, though the majority did not raise an alert.

No additional public reputation services, such as Google Safe Browsing, have published a verdict, and no further attribution, such as ASN, country, or associated phishing kit, is available in the current data set. The limited evidence points to a generic phishing infrastructure that leverages a reputable hosting provider to obscure the true operator. Because the site is hosted on a shared CDN, traditional network‑level blocking may affect unrelated legitimate sites, so defenders should employ URL‑based filtering rather than blanket IP blocks. The presence on PhishDestroy and the two VirusTotal detections provide actionable indicators that can be incorporated into intrusion‑detection signatures, proxy blocklists, and email security gateways.

Organizations should monitor outbound traffic for attempts to resolve or contact the domain, enforce strict TLS inspection policies to detect potential credential exfiltration, and educate users about unexpected requests for booking or shopping credentials that reference Dubai or the “booking‑comaeu” pattern. At present, no public page title or content snapshot has been released, so the exact visual lure employed by the site remains unknown.