bookingcom-dubaishopping[.]webflow[.]io

bookingcom-dubaishopping.webflow.io is currently listed as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IP address 104.18.36.248, which is hosted on the Webflow platform; the registration was performed through Webflow’s service, a common choice for rapid site deployment. Threat intelligence aggregators have identified the domain on a single security blocklist and it has been explicitly blocked by the PhishDestroy sinkhole.

VirusTotal analysis shows that five of ninety‑one scanned scanners flag the domain as malicious, indicating that a subset of detection engines recognize malicious characteristics. No additional metadata such as page title, SSL certificate details, or HTTP response codes are available in the public feed, leaving the exact payload and lure mechanisms unconfirmed. However, the convergence of blocklist presence, partial VirusTotal detections, and the active status suggests that the domain is being used to host phishing content, likely targeting users of the “booking.com” brand based on the domain naming pattern.

Defenders should immediately add the domain and its resolved IP address to network deny lists, monitor outbound connections for traffic to 104.18.36.248, and enforce URL filtering rules that block any request to this host. Continuous re‑scanning on VirusTotal and periodic checks of the hosting provider’s abuse reporting channels are recommended to capture any changes in detection status. Organizations should also alert end‑users about the potential threat and advise verification of URLs before entering credentials on any site that references “booking.com” or related travel services.