login[.]booking-comsdubai[.]webflow[.]io

Analysis of login.booking-comsdubai.webflow.io, created on June 12, 2026, shows an elevated‑risk credential phishing profile. The domain was registered through the Webflow platform, a service that provides hosted website builders and does not inherently imply malicious intent, but the rapid creation date combined with other indicators raises concern. Passive DNS resolution maps the domain to the IP address 104.18.36.248, a host commonly associated with content‑delivery networks rather than dedicated malicious infrastructure, suggesting the attacker leveraged a legitimate CDN to mask activity.

VirusTotal scans report that 2 of 91 security vendors flagged the domain, indicating that at least a small subset of detection engines have identified suspicious characteristics, though the majority did not raise an alert. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the perception of phishing use. No public evidence of SSL certificate details, HTTP response codes, or page title content is available, leaving the content of the landing page unverified.

Given the confirmed registration, IP resolution, vendor detections, and blocklist inclusion, defenders should treat the domain as malicious. Recommended actions include adding the domain to network‑level deny lists, updating endpoint phishing filters, and monitoring for any outbound connections to the associated IP. Continuous re‑evaluation is advised, as additional detections or blocklist entries may emerge, clarifying the threat’s scope.