login[.]bookingdubai--com[.]webflow[.]io

The domain login.bookingdubai--com.webflow.io was registered on June 12, 2026 through the Webflow platform, which is commonly used for rapid website deployment. It resolves to the IP address 104.18.36.248, an address owned by Cloudflare and frequently leveraged by malicious actors to hide true hosting locations. Threat intelligence sources indicate that the domain is currently active and has been assigned an elevated risk level.

It appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, suggesting that at least one defensive feed has identified it as malicious. VirusTotal analysis shows that 1 of 91 security vendors flagged the domain, reinforcing the suspicion of malicious intent despite a low overall detection count. No public page title or SSL certificate details have been disclosed, and no Safe Browsing or Open Threat Exchange entries are available, leaving the full surface‑level characteristics of the site unverified.

The limited detection footprint combined with the presence on a blocklist and Cloudflare hosting points to a credential‑phishing campaign that likely harvests login credentials, though the specific target brand cannot be confirmed from the available data. Defenders should update URL filtering rules to block or monitor this domain, enforce multi‑factor authentication for accounts that could be targeted, and consider isolating traffic to Cloudflare‑hosted IPs that lack a reputable reputation. Continuous monitoring of VirusTotal, blocklist feeds, and any emerging threat‑intel reports is recommended to capture further indicators of compromise should the infrastructure evolve.