support[.]booking-dubaii-shopping[.]webflow[.]io

Analysis of support.booking-dubaii-shopping.webflow.io shows a newly created web presence that aligns with a generic phishing campaign. The domain was registered on June 12, 2026 through the Webflow platform, a service that provides hosted website construction and automatically assigns Cloudflare edge addresses. DNS resolution returns the IP address 104.18.36.248, which belongs to the Cloudflare network and therefore masks the underlying origin server.

VirusTotal reports that one of ninety‑one scanning engines has flagged the domain as malicious, indicating that at least one security vendor has observed suspicious behavior. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that community‑driven defenses have identified it as hostile. No additional intelligence such as SSL certificate details, HTTP response codes, or page‑title information is currently available, leaving the exact content of the site unverified.

The limited but consistent signals—recent registration, Webflow hosting, Cloudflare IP, a vendor detection, and blocklist inclusion—support a high confidence rating that the domain is being used for phishing. Defenders should add the domain to network and endpoint deny lists, monitor for other Webflow‑hosted subdomains that exhibit similar registration timestamps, and consider employing DNS‑level filtering for Cloudflare edge addresses associated with newly created sites. Continuous re‑evaluation is advised in case additional indicators, such as payload analysis or victim reports, become available.