booking--com--dubai[.]webflow[.]io

The domain booking--com--dubai.webflow.io was observed on July 29, 2026 as an active generic phishing infrastructure. Registration is tied to the Webflow SaaS platform, which provides drag‑and‑drop website hosting. The host resolves to the IP address 104.18.36.248, a Cloudflare edge node commonly used for legitimate content delivery as well as for malicious front‑ends. VirusTotal analysis shows that five of ninety‑one scanning engines returned a positive detection, indicating partial consensus among security vendors.

The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one commercial threat‑intelligence feed has categorized it as malicious. No additional public reputation scores, SSL certificate details, or HTTP status codes are available in the current intelligence set, leaving the exact page content and credential‑harvesting mechanisms unverified. Defenders should consider adding the domain to deny‑list rules at perimeter firewalls, proxy filters, and endpoint web controls.

Monitoring for connections to the associated Cloudflare IP and for any future VirusTotal or blocklist updates is advisable. Continuous observation of the Webflow hosting environment may reveal additional malicious sub‑domains that share the same IP range. In the absence of further technical artefacts, the precautionary stance should remain elevated until the domain is taken offline or its activity is otherwise mitigated.