bookingcomdubaii[.]webflow[.]io

The domain bookingcomdubaii.webflow.io is currently active and has been identified as a generic phishing infrastructure. Registration information shows the domain was provisioned through the Webflow hosting platform, which is commonly used for legitimate website creation but also abused by malicious actors to obtain quickly deployable sites. DNS resolution points the domain to the IP address 104.18.36.248, an address associated with Cloudflare's edge network, making attribution to a specific operator difficult and providing built‑in DDoS mitigation. VirusTotal analysis indicates that three of ninety‑one antivirus and URL reputation engines flagged the domain as malicious, demonstrating partial detection across the security ecosystem.

Additionally, the domain appears on one public security blocklist, and it has been explicitly blocked by the PhishDestroy phishing mitigation service. No publicly available page title, SSL certificate details, or HTTP response codes have been disclosed, and the underlying content has not been analyzed, leaving the exact impersonated brand or lure unknown. The lack of a publicly observed brand target means defenders cannot rely on brand‑specific filters; instead, they should employ generic URL and IP reputation controls.

Recommended defensive actions include adding bookingcomdubaii.webflow.io to web proxy and DNS filtering policies, extending blocklists to include its resolving IP 104.18.36.248, and monitoring for any traffic spikes to that address. Organizations using Webflow should review any newly created sub‑domains for anomalous activity, and incident response teams should treat any user reports involving this domain as suspicious, isolating potential credential theft attempts. Continuous monitoring of VirusTotal and other reputation services is advised to capture any changes in detection status.