staging[.]booking-comsdubai[.]webflow[.]io

The domain staging.booking-comsdubai.webflow.io is currently active and classified as a generic phishing site targeting credentials. The domain was registered on June 12 2026 through the Webflow platform, which provides hosting and site‑building services. PhishDestroy has already added the domain to its blocklist, indicating that the site is known to be used for malicious purposes. VirusTotal analysis shows that 2 of 91 scanned security vendors flagged the domain, confirming the presence of malicious indicators despite a relatively low detection ratio.

Additionally, the domain appears on one external security blocklist, further corroborating its malicious status. Public intelligence does not yet reveal the hosting IP address, SSL certificate details, or HTTP response codes, and no Safe Browsing, OTX, or other reputation services have published findings for this host. The lack of additional technical artefacts suggests that the campaign may be in an early stage or that the operators are leveraging Webflow's infrastructure to obscure attribution. Defenders should immediately block any network traffic to staging.booking-comsdubai.webflow.io at the DNS and firewall layers.

Email security gateways should be updated to flag URLs containing this domain, and endpoint protection solutions should be configured to treat detections from the two VirusTotal‑identified vendors as malicious. Continuous monitoring of Webflow‑hosted domains for similar patterns is recommended, and security teams should consider leveraging threat‑intel feeds that reference PhishDestroy listings to enrich detection rules. Because the domain is newly created, rapid propagation of indicators of compromise such as the domain name itself, associated IP ranges if later discovered, and any observed URLs should be shared with upstream partners via ISACs or industry‑wide sharing platforms.