d2ggmj18h1as73d32ltg[.]bookinggcomdubaithingstodo[.]webflow[.]io

The domain d2ggmj18h1as73d32ltg.bookinggcomdubaithingstodo.webflow.io was registered through the Webflow platform on June 12, 2026. Infrastructure analysis shows it resolves to the IP address 104.18.36.248, a host that is commonly used for legitimate web‑hosting services. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one external security source has identified it as malicious.

VirusTotal records indicate that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the vendors raised a detection at the time of the scan, but the absence of a detection does not constitute evidence of benign behavior. The threat type is classified as generic phishing and the current risk level is listed as “under investigation” while the operational status remains active. Definitive conclusions about the payload or credential‑harvesting mechanisms cannot be drawn because no page content, SSL certificate details, HTTP response codes, or brand‑specific indicators have been released.

Consequently, defenders should treat the domain as suspicious: block DNS resolution, add the IP address to network‑level deny lists, monitor for any outbound connections to the host, and continue to collect telemetry such as HTTP headers and page titles if the site is accessed in a controlled environment. Ongoing correlation with future blocklist entries and any emerging vendor detections will be required to refine the risk assessment.