bookingcomdubbai[.]webflow[.]io

The domain bookingcomdubbai.webflow.io was first registered on June 12, 2026 through the Webflow platform, indicating the use of a legitimate website‑building service for malicious purposes. DNS resolution points to the IPv4 address 104.18.36.248, a host that is part of a large content‑delivery network often leveraged to obscure the true origin of abusive traffic. As of the analysis date, the domain is classified as active with an elevated risk rating.

Threat intelligence sources have identified the site as a generic phishing vector; 13 of 91 security vendors scanned by VirusTotal have flagged the domain as malicious. Independent blocklist monitoring shows the domain is present on one security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the consensus that the infrastructure is being used to host fraudulent content. No public information is available regarding SSL certificate details, HTTP response codes, or page title, and the specific brand or service being spoofed has not been disclosed in the current intelligence set.

Consequently, defenders should treat any traffic to or from bookingcomdubbai.webflow.io as suspicious. Recommended mitigation steps include adding the domain to network and endpoint deny lists, updating URL filtering policies to block the host, and monitoring for any related command‑and‑control traffic originating from the associated IP address. Continuous re‑evaluation is advised, as further analysis of the landing page content may reveal additional indicators of compromise or targeted victim profiles.