booking-comarab-dubai-shopping[.]webflow[.]io

The domain booking-comarab-dubai-shopping.webflow.io is flagged as an active generic phishing site with an elevated risk rating. Registration information indicates the domain was created through the Webflow hosting platform, which commonly provides shared infrastructure for user‑generated sites. DNS resolution points to the IP address 104.18.36.248, an address belonging to the Cloudflare network, suggesting the attacker is leveraging a reputable CDN to obscure origin and benefit from built‑in DDoS mitigation. VirusTotal analysis shows that five of ninety‑one scanning engines have reported malicious behavior for this domain, confirming a detectable threat vector despite the majority of scanners not flagging it.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, providing additional evidence that threat‑intelligence feeds consider it malicious. No further public threat‑intel such as OTX entries, SSL certificate anomalies, or detailed page‑title information is currently available. Defenders should treat any traffic to this domain as hostile.

Immediate actions include adding the host to URL filtering policies, updating DNS blocklists to include the resolved IP 104.18.36.248, and monitoring for outbound connections that may indicate compromised clients attempting to exfiltrate credentials. Because the site is hosted on a shared Webflow environment, broader network‑wide blocking of the entire Webflow.io subdomain may generate false positives for legitimate services; therefore, selective blocking of the specific host is recommended. Continuous re‑scanning with VirusTotal and monitoring of PhishDestroy alerts are advised to capture any changes in detection status.