bookingdubai--com[.]webflow[.]io

The domain bookingdubai--com.webflow.io is currently flagged as an active generic phishing threat. Infrastructure analysis shows the domain was registered through Webflow, a platform that provides hosted sites on shared infrastructure. DNS resolution points to IP address 104.18.36.248, a host commonly associated with Cloudflare‑backed services, indicating the site is leveraging a content‑delivery network rather than a dedicated server. Threat intelligence indicates the domain has been blocked by the PhishDestroy sinkhole and appears on one external security blocklist, confirming that at least one reputable anti‑phishing organization has taken enforcement action against it.

VirusTotal scans have returned detections from two of ninety‑one security vendors, providing independent confirmation that the site exhibits malicious characteristics. No additional metadata such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts are presently available, leaving the exact content and lure techniques of the page unverified. The limited detection footprint suggests the site may be newly deployed or employing evasion tactics that avoid broader vendor coverage.

Defenders should immediately block the domain at DNS, proxy, and firewall layers, and consider adding the associated IP address to network‑wide deny lists, recognizing that the IP may host benign sites as well. Continuous monitoring of VirusTotal, PhishDestroy, and other blocklist feeds is recommended to capture any escalation in detection counts or additional indicator updates. Organizations should also educate users about unsolicited communications that reference Dubai booking services, as the domain name itself is crafted to appear legitimate and could be used in credential‑harvesting campaigns.