dubai-booking-comm[.]webflow[.]io

The domain dubai-booking-comm.webflow.io was registered on June 12, 2026 through the Webflow platform. It currently resolves to the IPv4 address 172.64.151.8, which is hosted by the Cloudflare network. The domain appears on one security blocklist and is actively blocked by the PhishDestroy service, indicating that multiple threat intelligence feeds have identified it as malicious. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, confirming a low‑to‑moderate detection rate across the scanning ecosystem. The risk rating assigned to the indicator is elevated and its operational status is listed as active, meaning that the infrastructure is still in use for malicious activity.

The available evidence points to a generic phishing campaign. No additional context such as a specific brand impersonated, page title, or SSL certificate details have been disclosed, so the precise payload or victim‑targeting vector remains unknown. The limited detection footprint—only two vendor detections and a single blocklist entry—suggests that the campaign may be newly deployed or employing evasive techniques to avoid broader detection. Nonetheless, the presence of the domain on PhishDestroy’s blocklist and the fact that it resolves to a public‑facing IP address used for content delivery warrant immediate precautionary actions.

Defenders should add dubai-booking-comm.webflow.io to network‑level deny lists, configure DNS filtering to block resolution, and monitor outbound traffic for connections to 172.64.151.8. Continuous re‑scanning on VirusTotal and periodic checks against threat‑intel platforms are recommended to capture any change in detection prevalence. Organizations employing Webflow‑based hosting should review their own usage policies, as the registrar information indicates that the domain was created through a legitimate SaaS service but leveraged for malicious purposes.