booking--com-dubai[.]webflow[.]io

On July 29, 2026, analysis of the domain booking--com-dubai.webflow.io indicates that it is being used for phishing. The domain was registered on June 12, 2026 via the Webflow platform, which provides hosting and DNS services for user‑generated sites. DNS resolution points to the address 104.18.36.248, an IP owned by Cloudflare’s network, a common choice for malicious actors because it masks the underlying server location. VirusTotal has recorded detections from two of ninety‑one scanned security vendors, confirming that at least a subset of scanners classify the host as malicious.

The domain also appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, further corroborating its malicious reputation. No additional public intelligence such as Google Safe Browsing status, Open Threat Exchange reports, SSL certificate details, or HTTP response codes is currently available, leaving a gap in the technical fingerprint of the site. The limited age of the domain—just over six weeks old—suggests a rapid deployment typical of phishing campaigns seeking to exploit brand‑related keywords.

Defenders should add the domain to internal block lists, monitor DNS queries for the IP 104.18.36.248, and enforce outbound filtering to prevent credential submission to this host. Because the site is hosted on a shared Webflow infrastructure, any related subdomains created by the same account may share the same IP and should be considered suspicious until verified. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection rates, and organizations should update threat feeds with the observed indicators of compromise.