web-bookingcomdubai[.]webflow[.]io

Analysis conducted on 29 July 2026 indicates that the domain web-bookingcomdubai.webflow.io is actively being used for a generic phishing campaign. The domain was registered on 12 June 2026 through the Webflow platform, a service that provides hosted website creation. DNS resolution points to the IP address 104.18.36.248, which is part of a cloud-based content delivery network commonly leveraged for legitimate traffic, making network-level attribution difficult. VirusTotal reports that 14 of 91 scanning engines have flagged the domain as malicious, confirming a consensus of concern among security vendors.

The domain is currently listed on one external blocklist and has been explicitly blocked by the PhishDestroy feed, further evidencing its malicious classification. The risk rating assigned is elevated, and the status remains active, implying ongoing operation. The available intelligence does not disclose additional characteristics such as TLS certificate details, HTTP response codes, or page content beyond the generic phishing label. Consequently, the precise lure technique, credential collection endpoint, or targeted brand cannot be confirmed at this time.

Defenders should treat the domain as hostile: it should be added to network deny-lists, DNS filtering policies, and endpoint web protection rules. Continuous monitoring of the associated IP address for changes in traffic patterns is advised, as well as periodic re-scanning on multi-engine platforms to capture any evolution in the payload or hosting configuration. Organizations employing Webflow for legitimate sites should verify that their own subdomains are not inadvertently compromised. Incident response teams should collect any logs that reference connections to 104.18.36.248 and correlate them with user activity to identify potential compromise.