booking-com--dubai[.]webflow[.]io

The domain booking-com--dubai.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to IP address 104.18.36.248, an address associated with Cloudflare’s edge network commonly used for Webflow‑hosted sites. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy, indicating that threat‑intel feeds have identified it as malicious. A VirusTotal scan recorded detections from 2 of 91 security vendors, providing independent confirmation of suspicious activity.

The short lifespan of the domain, combined with the inclusion of the “booking-com” string and a Dubai qualifier, suggests an attempt to masquerade as a Booking.com service targeting users interested in travel bookings in the United Arab Emirates. The current risk rating is elevated and the status is active, meaning the infrastructure is presently reachable and may be delivering phishing content.

Defenders should add the domain to DNS and URL filtering rules, monitor outbound traffic for connections to 104.18.36.248, and advise users to avoid any credential entry on pages hosted under this subdomain. Continuous re‑evaluation of vendor detections and blocklist updates is recommended to capture any further escalation or changes in the threat actor’s tactics.