bokingcodubai[.]webflow[.]io

Analysis of the domain bokingcodubai.webflow.io indicates an active phishing campaign targeting users through a booking-themed fraudulent site. The domain was registered on June 12, 2026, via Webflow, a platform commonly used for both legitimate and malicious web projects. As of July 29, 2026, the domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare's content delivery network, a frequent choice for threat actors seeking to obscure hosting origins and evade IP-based blocking. Detection data from VirusTotal reveals that 2 out of 91 security vendors have flagged this domain as malicious, suggesting early but limited recognition of its phishing activity. The domain also appears on at least one security blocklist, specifically PhishDestroy, which has implemented active blocking measures.

The combination of low detection counts and blocklist inclusion indicates an elevated risk level, as the domain is sufficiently suspicious to warrant preventive action despite not yet being widely recognized by security vendors. Infrastructure analysis reveals that the domain is hosted on Webflow's subdomain platform, which provides a low-cost and low-friction means for threat actors to deploy phishing pages without requiring dedicated hosting or domain registration. The use of a subdomain under webflow.io further complicates attribution and takedown efforts, as Webflow's infrastructure hosts millions of legitimate sites. No additional details regarding the specific brand targeted, phishing kit used, or page content are currently available, as the site's exact content has not yet been analyzed beyond its classification as a generic phishing domain. Defenders are advised to treat this domain as an active threat.

Network-level blocking should be implemented for 104.18.36.248 and the domain bokingcodubai.webflow.io.