links[.]bookingcomsfdubaishopping[.]webflow[.]io

Analysis shows that the domain links.bookingcomsfdubaishopping.webflow.io was registered on June 12 2026 through the Webflow platform, a service commonly used for rapid site deployment. Within a short window the domain appeared on a security blocklist, and PhishDestroy has actively blocked it. VirusTotal scanned the host and recorded a single positive detection out of 91 antivirus engines, indicating that at least one vendor identified malicious behavior associated with the domain. The limited detection footprint suggests a nascent campaign that may still be under observation by many security products.

No public DNS records, IP address, or autonomous system information have been disclosed, and no SSL certificate details or HTTP response codes are currently available. Likewise, page‑title metadata, safe‑browsing verdicts, and threat‑intel feeds such as OTX have not published observable indicators for this host. Consequently, the precise phishing vector—whether it targets credential harvesting, credential‑filled forms, or redirects to secondary payload sites—cannot be determined from the present evidence. Defenders should proactively deny any outbound or inbound traffic to this fully qualified domain name at network perimeter devices, DNS resolvers, and endpoint protection suites.

Continuous monitoring of the domain’s resolution and any emergent reputation changes is recommended, as additional detections may surface as the campaign matures. Organizations using Webflow‑hosted assets should verify that their own subdomains are not being abused for malicious redirects. Incident response teams that encounter related phishing emails should treat any URLs pointing to this domain as malicious and isolate the associated messages.