booking-comaeu-dubai-hotels[.]webflow[.]io

Analysis as of July 29 2026 indicates that the domain booking-comaeu-dubai-hotels.webflow.io resolves to the IPv4 address 172.64.151.8, a host commonly associated with the Webflow hosting platform and fronted by Cloudflare infrastructure. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that it is being treated as malicious by at least one reputable anti‑phishing feed. VirusTotal has processed the domain and six out of ninety‑one scanning engines returned a positive detection, reinforcing the suspicion of phishing activity.

The registration record shows the domain was created through Webflow, a legitimate website‑building service that can be abused to host fraudulent pages. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange (OTX) tags, SSL certificate details, HTTP response codes, or page‑title metadata is currently available. The lack of public metadata does not mitigate the observed indicators; the combination of active blocklisting, multiple vendor detections, and hosting on a platform frequently leveraged for abuse warrants an elevated risk rating.

Defenders should add the domain to internal blocklists, monitor outbound DNS queries for the associated IP, and enforce URL filtering rules that deny connections to any sub‑domains of webflow.io that are not explicitly authorized. Continuous re‑evaluation is advised, as further analysis of the hosted content may reveal additional threat vectors or victim targeting.