bookingcomdubaiae[.]webflow[.]io

On July 29, 2026, threat analysts evaluated the domain bookingcomdubaiae.webflow.io and classified it as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IP address 104.18.36.248, which is associated with a large content‑delivery network commonly used for rapid site deployment. Registration information indicates the domain was created through the Webflow service, a platform that provides easy website hosting and does not inherently imply malicious intent but offers anonymity for abuse.

VirusTotal scans show that two of ninety‑one security vendors have flagged the domain, providing modest but notable detection evidence. The domain appears on a single external security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its malicious reputation. No additional intelligence such as SSL certificate details, page titles, or brand targeting has been published, leaving the exact content of the hosted page unverified.

Consequently, defenders cannot confirm the specific lure or credential‑stealing mechanics employed, only that the infrastructure is being used for phishing attempts. Given the confirmed detections, blocklist entries, and hosting characteristics, security teams should add bookingcomdubaiae.webflow.io to URL filtering rules, monitor outbound DNS queries for the associated IP, and consider broader network‑wide containment for related Webflow‑hosted assets. Continuous re‑evaluation is advised, as further analysis of the site’s payload could reveal additional indicators of compromise.