bookingcomshopping-dubai[.]webflow[.]io[.]webflow[.]io

This domain, bookingcomshopping-dubai.webflow.io.webflow.io, was registered on June 12, 2026 through the Webflow platform. DNS resolution points to the address 104.18.36.248, which belongs to the infrastructure used by Webflow‑hosted sites. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, indicating that defensive feeds have already identified malicious activity. VirusTotal analysis shows that three out of ninety‑one scanning engines have flagged the domain, providing independent corroboration of its suspicious nature.

The threat classification supplied is generic phishing, and the risk level is marked as elevated with an active status, suggesting ongoing use in malicious campaigns. Evidence currently available does not include a page title, SSL certificate details, HTTP response codes, or any observed payload. Consequently, the exact content served by the site remains unknown, and further investigation is required to confirm whether it hosts credential‑stealing forms, redirects, or other malicious payloads. Defenders should treat the domain as hostile and block all outbound connections to it.

In addition, security tooling should be updated to include the domain in URL filtering, DNS sinkholing, and intrusion‑prevention signatures. Continuous monitoring of the associated IP address 104.18.36.248 is advised, as shared hosting environments may host additional malicious domains. Organizations should also review any recent logs for connections to this domain or its IP, especially from users who may have received unsolicited communications referencing Booking.com or shopping services in Dubai. Because the domain is freshly created, threat actors may be leveraging the reputable Webflow hosting to evade reputation‑based controls, so a proactive blocking stance is warranted until further forensic analysis clarifies the payload.