d4d5ta9cpoos73dgiidg[.]dubaii-booking-com[.]webflow[.]io

Analysis indicates that the sub‑domain d4d5ta9cpoos73dgiidg.dubaii-booking-com.webflow.io was created on June 12, 2026 and registered through the Webflow service, which supplies hosted web‑site infrastructure to a broad range of users. DNS resolution for the domain points to the address 104.18.36.248, an IP address owned by Cloudflare’s global edge network. Cloudflare hosting is frequently leveraged by both legitimate sites and malicious operators to obscure the true origin of abusive traffic. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, demonstrating that at least one commercial threat‑intelligence source has classified the domain as malicious.

VirusTotal analysis shows that three of ninety‑one antivirus engines flag the domain, providing modest but non‑trivial detection evidence that corroborates the blocklist entry. The threat is categorised as generic phishing with an elevated risk rating and remains active as of the report date, July 29, 2026. No additional intelligence such as SSL certificate details, HTTP response codes, page‑title content, or visual page analysis is presently available, limiting the depth of content‑level assessment.

The lack of publicly observable page attributes means that defenders cannot confirm the specific lure or credential‑harvesting technique employed, only that the infrastructure aligns with known phishing patterns. Recommendations for mitigation include adding the full host name to network deny‑list rules, monitoring DNS queries for the associated Cloudflare IP to detect potential collateral malicious domains, and applying heuristic‑based blocks for traffic targeting the Webflow namespace, especially when combined with the observed blocklist and detection signals.