booking-com--dubaii[.]webflow[.]io

Analysis of booking-com--dubaii.webflow.io shows an active generic phishing infrastructure with an elevated risk rating. The domain was registered on June 12, 2026 through the Webflow platform, which is commonly used for rapid site deployment and does not inherently indicate malicious intent. DNS resolution points to the IP address 104.18.36.248, a host that is currently listed on a single security blocklist and has been flagged by PhishDestroy.

VirusTotal reports that two out of ninety-one scanning engines have identified the domain as malicious, providing limited but corroborating evidence of abuse. The presence on a blocklist and the detection by multiple security vendors suggest that the domain is being used to host phishing content, though the exact payload or target brand has not been publicly disclosed. Defenders should treat any traffic to this domain as potentially harmful.

Recommended mitigation steps include adding the domain to outbound filtering rules, monitoring DNS queries for the resolved IP, and enforcing web gateway blocks based on the observed blocklist entries. Continuous re‑evaluation is advised, as additional intelligence such as page title, SSL certificate details, or further vendor detections may emerge and refine the risk assessment.