booking-com-dubaai-paackages[.]webflow[.]io

The domain booking-com-dubaai-paackages.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 104.18.36.248. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, indicating that at least a small subset of scanners have identified malicious characteristics. The domain is currently listed on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that threat‑intelligence feeds consider it hostile.

No additional public intelligence such as page title, SSL certificate details, or HTTP response codes is available, leaving the exact content and delivery mechanism of the site unverified. The limited detection coverage (2/91) suggests that many scanners have not yet identified the payload, but the presence on a dedicated anti‑phishing blocklist provides concrete evidence of malicious intent, likely aimed at credential harvesting given the generic phishing classification. Defenders should add the domain to outbound filtering rules, enforce DNS‑based blocking, and monitor network traffic for connections to 104.18.36.248.

Incident response teams should treat any user‑initiated connections to this host as suspicious and consider isolating affected endpoints. Continuous re‑evaluation is advised, as additional detections may emerge from broader scanner coverage or from deeper analysis of the site’s content.