drupal[.]aebooking-com-dubai-shopping[.]webflow[.]io

The domain drupal.aebooking-com-dubai-shopping.webflow.io was registered on June 12, 2026 through the Webflow registrar and resolves to the IP address 104.18.36.248. VirusTotal analysis shows that two of ninety‑one security vendors have flagged the domain, indicating a modest but non‑trivial detection rate. Independent threat‑intel feeds have added the domain to a single security blocklist and the anti‑phishing service PhishDestroy has confirmed it as malicious, classifying the activity as generic phishing.

No further public intelligence such as page title, SSL certificate details, or HTTP response codes is currently available, leaving the exact content and impersonated brand of the site unverified. Infrastructure analysis reveals the host is part of a cloud‑based content‑delivery network, which is common for short‑lived phishing sites that leverage reputable hosting to evade simple reputation checks. The limited detection footprint suggests the campaign is recent and possibly still in the deployment phase, consistent with the elevated risk rating.

Defenders should block the domain at the DNS and proxy layers, add the associated IP 104.18.36.248 to deny‑list rules, and monitor for related hostnames that share the same registrar or IP range. Continuous re‑scanning with multi‑vendor services is advised to capture any escalation in detection counts, and security teams should incorporate the domain into threat‑intel feeds to improve downstream protection.