shopping-bookingcomdubai[.]webflow[.]io

Analysis of shopping-bookingcomdubai.webflow.io indicates an active credential‑theft operation. The domain was registered on June 12 2026 through the Webflow platform, a service commonly used for rapid site deployment. DNS resolution points to the IP address 104.18.36.248, which belongs to a content‑delivery network and is shared by many legitimate sites, complicating host‑based blocking. Two of ninety‑one security vendors on VirusTotal have flagged the domain, providing early evidence of malicious classification.

The domain is listed on a single external blocklist and has been added to the PhishDestroy blocklist, confirming that at least one community‑driven sinkhole is actively denying traffic to it. No additional reputation signals such as Safe Browsing, OTX, or SSL/TLS anomaly data are currently published for the host. The public page title, HTTP response code, and content have not been captured, so the specific lure or credential‑capture mechanism remains unknown.

Defenders should treat the domain as high‑confidence malicious: ingest the domain and its resolving IP into network‑level deny lists, enforce URL filtering, and monitor outbound connections to the CDN address for anomalous patterns. Because the domain is hosted on a shared infrastructure, isolation of the IP may affect legitimate services; therefore, contextual analysis of traffic patterns is recommended before blanket IP blocking. Continuous re‑evaluation is advised, as further indicators such as page snapshots or additional vendor detections may emerge.