smtp[.]bookkingcoom--dubai[.]webflow[.]io

This domain is flagged as an active generic phishing site with an elevated risk rating. The fully qualified host smtp.bookkingcoom--dubai.webflow.io resolves to the IP address 104.18.36.248, which is part of the Cloudflare network commonly used by Webflow‑hosted sites. Registration information shows the domain was created on 12 June 2026 and the hosting service is listed as Webflow, indicating that the attacker leveraged a legitimate web‑development platform to obtain a free or low‑cost sub‑domain.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis reports that three out of ninety‑one scanners identified malicious characteristics, reinforcing the suspicion of phishing use. No additional public intelligence such as Safe Browsing verdicts, SSL certificate details, or HTTP response codes has been released for this host, leaving the exact page content and lure vector undocumented.

Defenders should therefore treat the domain as malicious, add the host to URL filtering and DNS sink‑hole lists, and monitor outbound connections to the associated IP address for anomalous activity. Continuous re‑evaluation is advised, as further analysis of the site’s page title, HTTP headers, and potential credential‑stealing forms may reveal additional indicators of compromise.