booking-com-dubaai-hotteels[.]webflow[.]io

Analysis date July 29 2026. The domain booking-com-dubaai-hotteels.webflow.io was registered on June 12 2026 through the Webflow platform. The domain resolves to IP 104.18.36.248, an address owned by Cloudflare, indicating the use of a shared CDN service for hosting. PhishDestroy has already added the domain to its blocklist, and it appears on one additional security blocklist.

VirusTotal reports that 2 of 91 scanned security vendors flagged the domain, confirming that at least a minority of scanners have identified malicious behavior. The threat type is classified as generic phishing, and the risk level is elevated with an active status. No public Safe Browsing, OTX, or SSL certificate details are available in the current intelligence. The page title and content have not been publicly disclosed, so the specific lure or credential‑stealing mechanisms remain unknown.

Given the recent creation date, the association with a known phishing blocklist, and the presence of detections on VirusTotal, the domain should be treated as malicious. Defensive recommendations include adding the domain to local deny lists, blocking outbound connections to the resolved IP, monitoring DNS queries for the domain, and leveraging threat‑intelligence feeds that include the PhishDestroy entry. Continuous re‑evaluation is advised, as additional analysis of the web content may reveal further indicators such as credential‑capture forms or brand impersonation.