investors[.]booking-dubaii-shopping[.]webflow[.]io

The domain investors.booking-dubaii-shopping.webflow.io was registered on June 12, 2026 through the Webflow hosting platform and currently resolves to the IP address 104.18.36.248. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, indicating that defensive feeds have identified it as a malicious resource. VirusTotal analysis shows that one out of ninety-one scanning engines has flagged the domain, providing an additional data point that corroborates its suspicious nature.

The limited blocklist presence suggests that the infrastructure is relatively new and may not yet be widely disseminated across intelligence feeds. No further public metadata such as ASN, country of hosting, SSL certificate details, or HTTP response codes are available in the supplied data, leaving those aspects of the hosting environment uncertain. Defenders should treat the domain as a high‑confidence phishing indicator and incorporate it into URL filtering, DNS sink‑hole, and web proxy policies.

Continuous monitoring of the IP 104.18.36.248 for new associations, as well as periodic re‑scans on VirusTotal and other sandbox services, is advised to capture any evolution of the payload or additional detections. Organizations that rely on email or web traffic filtering should ensure that the domain is explicitly denied, and incident response teams should be prepared to investigate any user reports that reference this URL.