booking-comdubai[.]webflow[.]io

Analysis indicates that booking-comdubai.webflow.io was registered via the Webflow platform on 12 June 2026. The domain resolves to the IP address 172.64.151.8, which is part of the Cloudflare network used by Webflow hosting. The site appears on a single security blocklist and has been actively blocked by PhishDestroy.

VirusTotal scans show that 2 of 91 security vendors have flagged the domain, confirming malicious intent. No additional public intelligence such as Safe Browsing entries, OTX reports, or SSL certificate anomalies are currently available. The limited detection footprint suggests a newly deployed campaign targeting users searching for booking services in Dubai.

Defenders should add the domain and its hosting IP to outbound and inbound filtering rules, monitor DNS queries for the domain and related subdomains, and enforce strict email authentication to reduce the likelihood of credential harvesting. Continuous re‑scanning with VirusTotal and inclusion in internal threat intel feeds is recommended to capture any escalation in detection counts. Given the recent creation date and early blocklist presence, the domain should be treated as an elevated‑risk phishing vector until further evidence either confirms takedown or indicates a false positive.