tcp[.]web-bookingcomdubai[.]webflow[.]io

This domain, tcp.web-bookingcomdubai.webflow.io, was registered on June 12, 2026 through the Webflow platform. It resolves to the IP address 104.18.36.248, which is owned by Cloudflare and is commonly used for hosting legitimate and malicious content alike. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one trusted sinkhole has identified it as malicious. VirusTotal has recorded 11 detections out of 91 scanning engines, confirming that multiple independent scanners have flagged the host as suspicious.

The elevated risk rating aligns with the observed detection activity and the recent creation date, which suggests a short‑lived infrastructure typical of phishing campaigns. No additional public intelligence such as SSL certificate details, HTTP response codes, page titles, or content analysis is currently available, leaving the exact nature of the payload or targeted brand undefined. Defenders should add the domain and its resolving IP address to outbound and inbound filtering rules, ensure that any internal DNS resolvers are configured to block lookups for the domain, and monitor network traffic for connections to 104.18.36.248.

Continuous re‑scanning on VirusTotal and other sandbox services is recommended to capture any evolving malicious behavior. Organizations using Webflow‑hosted assets should review their sub‑domain creation policies to prevent abuse of the platform for malicious impersonation. Until further forensic evidence is obtained, the domain should be treated as a high‑confidence phishing indicator and blocked at the perimeter.