app[.]booking-comsdubai[.]webflow[.]io

Analysis of app.booking-comsdubai.webflow.io, created on 12 June 2026 and hosted via Webflow, shows that the domain is actively used for phishing. The site is listed on one public security blocklist and has been blocked by the PhishDestroy sinkhole. VirusTotal scans returned detections from two of ninety‑one AV engines, confirming malicious intent.

DNS resolution points to IP address 104.18.36.248, an address commonly associated with Webflow’s content‑delivery infrastructure, indicating that the attackers are leveraging a legitimate hosting provider to obscure their activity. The registrar information confirms registration through Webflow, which does not disclose individual registrant details, limiting attribution. No public page title or SSL certificate details have been released, so the exact content and transport security posture remain unknown.

Defenders should add the domain to deny lists, monitor DNS queries for the 104.18.36.248 address, and enforce outbound filtering for any HTTP/S traffic to this host. Continuous re‑scanning on VirusTotal and other multi‑engine services is recommended to capture any changes in detection rates. Organizations receiving suspicious communications that reference Booking.com should treat any links to this sub‑domain as malicious and instruct users to avoid interaction.