bookingcommdubaithingstodo[.]webflow[.]io

The domain bookingcommdubaithingstodo.webflow.io resolves to the IP address 104.18.36.248, a Cloudflare edge node commonly used for sites hosted on the Webflow platform. Registration data shows the domain was created on June 12, 2026 and was registered through Webflow, indicating a very recent deployment typical of many phishing campaigns that rely on short‑lived domains. The domain appears on one security blocklist, PhishDestroy, and is flagged by two of ninety‑one security vendors on VirusTotal, providing concrete evidence of malicious activity.

The threat is classified as generic phishing, the risk level is elevated, and the status is active, confirming that the site is currently being used for malicious purposes. No additional intelligence such as Safe Browsing alerts, Open Threat Exchange entries, detailed SSL certificate information, HTTP response codes, trust scores, or page‑title analysis is available from the supplied data, leaving the exact content and credential‑harvesting mechanisms unverified. Defenders should treat the domain as hostile and take immediate mitigation steps: block the domain at perimeter firewalls and DNS resolvers, add it to internal URL filtering and threat‑intel feeds, and enable TLS inspection to capture any potential credential submission.

Continuous monitoring of DNS queries for the domain and periodic re‑scanning with VirusTotal or similar services are recommended to capture any changes in detection status. Given the recent creation date and the association with a known blocklist, the domain should be considered a high‑confidence phishing indicator until further evidence proves otherwise.