bookingcom-dubaii[.]webflow[.]io

The domain bookingcom-dubaii.webflow.io was observed on July 29, 2026 and is currently classified as a generic phishing site. VirusTotal has recorded three positive detections out of ninety‑one submitted scanners, indicating that a minority of AV engines have identified malicious behavior associated with the host. The domain appears on one external blocklist and has been added to the PhishDestroy blacklist, confirming that at least one commercial phishing‑mitigation service is actively filtering traffic to it.

DNS resolution points to the address 104.18.36.248, which belongs to the Webflow hosting platform; the registrar record shows the domain was created through Webflow’s automated registration service. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange tags, SSL certificate details, HTTP response codes, or page‑title metadata is presently available, so the exact content and lure technique remain unverified. Analysis indicates that the infrastructure is typical of short‑lived phishing campaigns that leverage legitimate web‑hosting providers to obtain a trusted TLS certificate and reduce detection latency.

Defenders should add the fully qualified domain name and its resolved IP address to network‑level deny lists, enforce DNS‑sinkhole policies, and ensure that email gateways flag any messages containing URLs that resolve to 104.18.36.248. Continuous monitoring of Webflow‑hosted subdomains for similar patterns is recommended, as the provider’s bulk‑creation workflow can be abused to spin up new malicious sites rapidly. Because the page itself has not been crawled, security teams are advised to request a manual sandbox capture if possible, and to treat any user‑initiated connections to this domain as malicious until further forensic analysis clarifies the payload.