booking-com-dubai-shoppingg[.]webflow[.]io

Analysis indicates that the domain booking-com-dubai-shoppingg.webflow.io was registered on June 12, 2026 through the Webflow platform, which provides hosted website services and automatically provisions TLS certificates. The domain resolves to IP address 104.18.36.248, an address owned by Cloudflare, a common CDN used by many legitimate sites but also by threat actors to hide origin infrastructure. VirusTotal reports that 15 of 91 scanned security vendors flag the domain, demonstrating that a notable minority of scanners have identified malicious characteristics. The domain appears on one public security blocklist and is specifically listed by the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service has taken action against it.

No additional intelligence such as page title, brand targeting, or detailed payloads is currently available. The combination of recent creation, use of a reputable hosting provider, and multiple vendor detections suggests a purposeful phishing campaign rather than an accidental misconfiguration. Defenders should consider the domain as high‑confidence malicious and block outbound and inbound traffic to the associated IP.

Adding the fully qualified domain name to DNS‑based deny lists, web‑proxy filters, and endpoint URL controls will mitigate user exposure. Continuous monitoring of the IP address for any changes in hosting or additional detection signatures is advised, as threat actors may shift infrastructure while retaining the same domain registration. Further investigation of the hosted content, once retrieved, can provide insight into the specific phishing lure and any credential‑stealing forms employed.