blog[.]booking-comuae-dubai-things-to-do[.]webflow[.]io

Analysis date: 29 July 2026. The fully qualified domain blog.booking-comuae-dubai-things-to-do.webflow.io was registered on 12 June 2026 through the Webflow platform. DNS resolution returns a single A record pointing to 104.18.36.248, an address associated with Cloudflare edge infrastructure. The domain appears on one public blocklist and is actively listed by PhishDestroy, indicating prior detection as a phishing vector.

VirusTotal reports that the domain has been examined by 91 scanning engines, none of which have raised a detection at the time of this review; the absence of a detection does not imply benign intent. No public Safe Browsing, OTX, or SSL certificate details were found in the current intelligence set, and no HTTP response code or page title information is available. The limited data suggests that the domain is being used as a short‑lived host for credential‑harvesting campaigns targeting users searching for travel‑related content, leveraging the familiar “booking‑com” string within the sub‑domain. Because the registration date is recent and the hosting service is a generic website builder, the infrastructure can be rapidly re‑provisioned.

Defenders should add the host to outbound filtering rules, enforce DNS blocklists that include the observed entry, and monitor for any traffic to the IP address 104.18.36.248 that originates from internal users. Continuous re‑scanning on VirusTotal and periodic checks of public blocklists are recommended to capture any future detections. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords and review account activity.