dev[.]booking-comaeu-dubai-hotels[.]webflow[.]io

The domain dev.booking-comaeu-dubai-hotels.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 104.18.36.248. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, indicating a modest but non‑trivial detection signal. The domain is listed on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes. No additional intelligence such as a page title, brand impersonation, or specific phishing kit has been released, so the exact content and attack vector remain unknown.

The limited detection history suggests the site may be newly deployed and still evading broader detection. Defenders should treat the domain as a confirmed phishing indicator and add it to network‑level deny lists, DNS sinkhole policies, and endpoint protection block rules. Continuous monitoring of the hosting IP (104.18.36.248) is advised, as the same address may host other malicious payloads.

Organizations should also watch for related subdomains or similar naming patterns that could be leveraged in future campaigns. Because the domain is hosted on a legitimate SaaS platform (Webflow), traditional URL reputation checks may be insufficient; therefore, integrating threat‑intel feeds that include this indicator into security information and event management (SIEM) pipelines will improve early detection. In the absence of further forensic detail, the recommended mitigation actions are to block network traffic to the domain, educate users about unexpected booking‑related communications, and retain the indicator for future correlation with phishing email campaigns.