cdn[.]bookkingcoom--dubai[.]webflow[.]io

Investigative analysis as of July 29, 2026 indicates that the domain cdn.bookkingcoom--dubai.webflow.io was registered on June 12, 2026 through the Webflow platform. The domain resolves to the IP address 104.18.36.248, an address belonging to the Cloudflare network that is commonly used for content delivery and web hosting. Within a month of its creation the domain was added to the PhishDestroy blocklist and appears on an additional security blocklist, reflecting early detection by threat‑mitigation services. VirusTotal scans show that three out of ninety‑one antivirus and URL‑reputation engines flagged the domain as malicious, providing independent corroboration of its abusive intent.

The limited detection footprint suggests a small‑scale or newly deployed phishing campaign that has not yet achieved broad distribution. No public SSL certificate details, HTTP status codes, or page title information have been disclosed, leaving the exact payload and targeted brand unspecified. The use of a Webflow sub‑domain together with Cloudflare hosting is a known tactic that affords rapid deployment and obscures the underlying infrastructure.

Defenders should incorporate the domain into web‑filtering and DNS‑sinkhole policies, prioritize updating blocklists that reference the address, and monitor associated IP ranges for similar patterns. Continuous re‑assessment is recommended, as the domain may evolve or be leveraged for additional malicious pages. The current evidence supports an elevated risk rating and warrants active remediation.