onlinebookingdubai[.]webflow[.]io

The domain onlinebookingdubai.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. It resolves to the IP address 104.18.36.248, an address that belongs to the Cloudflare network commonly used for content delivery and reverse‑proxy services. Threat intelligence indicates that the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed is monitoring the indicator. VirusTotal analysis shows that three of ninety‑one scanned security vendors have flagged the domain, providing a modest detection footprint that aligns with the “generic phishing” classification and an elevated risk rating.

The domain is currently listed as active in the source data. Publicly available details do not include the page title, SSL certificate attributes, HTTP response codes, or any identified target brand, leaving those components of the infrastructure unverified. No information on the specific phishing kit, geographic hosting location, or ASN is supplied, so the exact technique employed by the site—whether it hosts a credential‑harvesting form, redirects victims, or serves additional payloads—remains uncertain. Defenders should add onlinebookingdubai.webflow.io to internal blocklists and configure web filters to deny traffic to the host name and its resolved IP 104.18.36.248.

Monitoring for future VirusTotal scans, broader blocklist inclusions, or changes in detection counts is recommended to track the threat’s evolution. Organizations that host legitimate content on Webflow should review their sub‑domain usage and be prepared to issue rapid takedown requests to the hosting provider if malicious activity is confirmed. Correlating internal authentication logs with requests to this domain can help identify potential credential‑theft attempts and limit exposure.