dubai-book-ingcoms[.]webflow[.]io

Analysis of dubai-book-ingcoms.webflow.io shows the domain is currently active and associated with a generic phishing threat. The site is hosted on the IP address 172.64.151.8, which belongs to the Webflow hosting network, and the registrar record indicates the domain was created through Webflow’s registration service. VirusTotal reports that six of ninety‑one scanning engines have flagged the domain, providing modest but notable malicious indication across multiple independent vendors.

The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy mitigation platform, confirming that at least one commercial anti‑phishing solution has identified it as malicious. No additional public intelligence such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts is presently available, leaving those vectors unverified at this time. The evidence therefore confirms a confirmed phishing classification, but the limited breadth of observed infrastructure signals means the full scope of the campaign—such as targeted brands, payload types, or geographic focus—remains uncertain.

Defenders should prioritize blocking traffic to 172.64.151.8 and adding dubai-book-ingcoms.webflow.io to URL filtering rules, especially on email gateways and web proxies that enforce phishing protection. Continuous monitoring of VirusTotal and other multi‑engine aggregators is advised to capture any change in detection count, and periodic re‑scanning of the domain should be scheduled to detect potential evolution of the hosted content. Organizations using Webflow‑based sites may also wish to review any internal use of subdomains that could be inadvertently leveraged for similar attacks, applying strict subdomain isolation and content‑security policies where feasible.