static[.]bookingcomdubaithingstodoes[.]webflow[.]io

static.bookingcomdubaithingstodoes.webflow.io was first observed on June 12, 2026 when the registration record was created through the Webflow hosting platform. The domain resolves to the IP address 104.18.36.248, an address owned by a widely used content‑delivery network. Shortly after activation the domain appeared on a security blocklist and was added to the PhishDestroy watchlist, indicating active malicious use. VirusTotal analysis reports that 2 of 91 scanned security vendors flagged the domain, reinforcing the suspicion of abuse. The threat is classified as generic phishing, assigned an elevated risk rating, and remains active as of the report date, July 29, 2026.

Public intelligence does not include a page title, SSL/TLS details, or observed payload, so the exact phishing vector and any targeted brand are currently unknown. The limited detection footprint—only two vendor detections and a single blocklist entry—suggests the campaign may be in early stages or employing low‑visibility tactics. The use of a Webflow sub‑domain (static...webflow.io) aligns with prior abuse where adversaries exploit free hosting to host malicious landing pages while obscuring their infrastructure.

Defenders should block DNS resolution for static.bookingcomdubaithingstodoes.webflow.io, add the fully qualified domain name to URL filtering and email security policies, and monitor for traffic to the associated CDN edge IP. Enforcing HTTPS inspection, where feasible, can help detect credential‑harvesting attempts despite the lack of SSL fingerprint information. Continuous re‑scanning with VirusTotal and periodic checks against reputable blocklists are recommended to capture any escalation in detection counts. Organizations employing web‑application firewalls or secure web gateways should deny or subject requests to this host to additional scrutiny.