pop[.]comdubaibooking[.]webflow[.]io

Analysis of the domain pop.comdubaibooking.webflow.io indicates it is an active phishing site targeting users of travel or booking services, specifically impersonating Dubai-related booking platforms. The domain was registered on June 12, 2026, through Webflow, a platform commonly used for both legitimate and malicious websites. As of July 29, 2026, the domain resolves to the IP address 172.64.151.8, which is associated with hosting infrastructure that may obscure the true origin of the threat. Detection data from VirusTotal shows that 3 out of 91 security vendors have flagged this domain as malicious, suggesting early but growing recognition of its risk.

The domain appears on at least one security blocklist and is currently blocked by PhishDestroy, further confirming its classification as a phishing threat. The exact content or specific brand being impersonated beyond the 'Dubai booking' theme is not yet fully analysed, as no page title or detailed scam kit information is available. However, the structure of the domain name suggests an attempt to deceive users seeking travel or accommodation services in Dubai.

Defenders should treat this domain as an elevated risk and consider blocking or monitoring access to it. Given its recent registration and limited but confirmed detection, additional scrutiny is warranted, particularly for organizations in the travel, hospitality, or financial sectors that may be targeted by related phishing campaigns. No additional infrastructure details, such as autonomous system number (ASN) or hosting country, are currently available to further contextualize the threat.