forum[.]booking-comaeu-dubai-restaurants[.]webflow[.]io

Analysis conducted on July 29, 2026 identifies forum.booking-comaeu-dubai-restaurants.webflow.io as an active phishing domain targeting users through a credential-harvesting scheme. The domain was registered on June 12, 2026 via Webflow, a platform that allows rapid deployment of web content without traditional domain registration scrutiny. Infrastructure analysis reveals the site resolves to IP address 172.64.151.8, an address associated with Webflow's hosting environment, which may explain the low initial detection rate among security vendors. As of the latest assessment, the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal reports indicate that 3 out of 91 security vendors have flagged the domain as malicious, suggesting emerging but not yet widespread detection. No additional context regarding the specific brand impersonation or phishing kit is available from the current data; the exact content and structure of the phishing page remain unanalyzed. The domain's naming convention, incorporating 'booking-comaeu' and regional references, implies an attempt to deceive users into believing it is affiliated with a legitimate travel or hospitality service, though no confirmed brand attribution is present in the available intelligence. Defenders are advised to treat this domain as elevated risk due to its recent creation, active status, and detection by multiple security mechanisms.

Network-level blocking at the IP and domain level is recommended, alongside monitoring for credential submissions or redirects to this infrastructure. Organizations should also review Webflow-hosted subdomains for similar patterns, as the platform's ease of use may facilitate rapid deployment of additional phishing sites. Further analysis of the page content and associated infrastructure could provide clarity on the specific threat actor or campaign objectives.