bookingcomdubaiishoppiinng[.]webflow[.]io

Analysis of bookingcomdubaiishoppiinng.webflow.io indicates that the domain is actively being used for a generic phishing campaign. The domain was registered on June 12, 2026 through the Webflow platform, a service that provides hosted website creation and content delivery. Network resolution shows the domain pointing to IP address 104.18.36.248, which belongs to a Content Delivery Network (CDN) commonly used for legitimate web services, suggesting that the attacker is leveraging a reputable hosting provider to obscure malicious activity. VirusTotal reports that 2 of 91 security vendors have flagged the domain, confirming that at least a minority of scanners have identified suspicious behavior associated with the host.

The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy threat‑remediation service, providing additional corroboration of its malicious intent. No public evidence is available regarding the site’s SSL certificate, HTTP response codes, or page title, and the content of the landing page has not been publicly disclosed in the supplied intelligence. Consequently, defenders cannot assess the exact payload or credential‑harvesting mechanisms employed, but the presence of multiple independent detections warrants immediate defensive action.

Organizations should add the domain to web‑filter allow‑deny lists, configure proxy or firewall rules to block outbound connections to 104.18.36.248 for user agents that do not require CDN services, and monitor DNS query logs for any lookups of the domain or its associated IP. Incident response teams should also consider scanning internal endpoints for indicators of compromise that match the two vendor detections reported by VirusTotal, and update phishing awareness training to reference the newly observed domain pattern. Continuous re‑evaluation of the domain’s status is advised, as additional detections or content analysis may emerge over time.