booking-dubaii-shopping[.]webflow[.]io

The domain booking-dubaii-shopping.webflow.io is currently flagged as a phishing resource. Infrastructure analysis shows the domain resolves to the IP address 104.18.36.248, which is associated with the Webflow hosting platform. Registration data indicates the domain was created through Webflow, a legitimate website‑building service, suggesting the attacker leveraged a trusted registrar to obtain a seemingly benign SSL certificate and hosting environment.

Threat intelligence from multiple sources places the domain on one external blocklist and confirms that PhishDestroy has actively blocked it. VirusTotal scans report that six out of ninety‑one security vendors have identified the domain as malicious, reinforcing the suspicion of phishing activity despite the relatively low detection count. No public Safe Browsing, Open Threat Exchange (OTX), SSL certificate details, HTTP status codes, trust‑score metrics, or page‑title information are presently available, leaving those vectors unverified at this time.

The limited visibility into the site’s content means that analysts cannot yet confirm the exact phishing lure or target brand. Defenders should treat the domain as high‑risk: add the domain and its resolved IP address to outbound filtering rules, monitor DNS queries for repeated resolutions, and ensure that any internal phishing‑detection systems ingest the blocklist and VirusTotal indicators. Continuous re‑evaluation is advised, as additional telemetry such as page content snapshots or further vendor detections could clarify the attack’s scope and enable more precise mitigation steps.