server[.]bokingcodubai[.]webflow[.]io

Analysis as of July 29, 2026 indicates that server.bokingcodubai.webflow.io was registered on June 12, 2026 via Webflow's hosting platform. The domain has been listed on a single security blocklist and was actively blocked by PhishDestroy, suggesting that infrastructure associated with the site has been identified as malicious. VirusTotal records show that the domain was submitted for scanning and evaluated by 91 antivirus and URL‑reputation engines, none of which have raised a detection at the time of writing; however, the lack of a current detection does not constitute a clean bill of health and should be treated as a neutral data point.

No public Safe Browsing, Open Threat Exchange (OTX), or similar reputation services have published alerts for this domain, and no additional intelligence such as IP address, ASN, geographic location, SSL certificate details, HTTP response codes, or page title has been publicly disclosed. Consequently, the current evidence base is limited to registration metadata, blocklist presence, and the PhishDestroy block action. Given the limited but consistent indicators of abuse, defenders should treat server.bokingcodubai.webflow.io as a high‑confidence phishing candidate.

Recommended actions include adding the domain to local deny lists, configuring web‑filtering solutions to block any HTTP/HTTPS traffic to the host, and monitoring outbound DNS queries for the domain. Organizations should also consider reviewing recent email logs for messages containing the domain or similar Webflow‑hosted URLs, as attackers frequently leverage such short‑lived hosting services to deliver credential‑stealing pages. Continuous re‑evaluation is advised, as additional telemetry—such as threat‑intel feeds, URL scanners, or sandbox analysis—may emerge and refine the risk posture.