booking----tour--dubai[.]webflow[.]io[.]webflow[.]io

Analysis of booking----tour--dubai.webflow.io.webflow.io shows a newly registered Webflow sub‑domain created on 12 June 2026. The registrar information confirms the site was provisioned via the Webflow hosting service, which is frequently abused for short‑lived phishing infrastructure. VirusTotal has recorded 4 of 91 scanned security vendors flagging the domain as malicious, indicating that a minority of vendors have identified suspicious behavior, though the majority have not flagged it. The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy filtering service, providing additional evidence of malicious intent.

No public IP address, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are currently available in the intelligence feed, limiting the ability to assess the underlying hosting environment or the presence of TLS encryption. The page title and any content‑level indicators have not been disclosed, so the specific lure or credential‑harvesting technique remains unknown. Given the combination of a recent creation date, a Webflow‑based sub‑domain, multi‑vendor detections, and inclusion on a phishing‑focused blocklist, the site should be treated as an elevated‑risk phishing resource.

Defenders should add the full domain to perimeter block lists, enforce URL filtering to deny outbound connections, and monitor DNS logs for queries to the domain. Incident response teams should also consider isolating any user‑initiated connections and reviewing recent authentication attempts for compromised credentials. Continuous re‑evaluation is advised as additional threat intel, such as host‑level analysis or page content extraction, may become available.