booking-com-dubai-resturants[.]webflow[.]io

Analysis as of July 29 2026 indicates that the domain booking-com-dubai-resturants.webflow.io is being used in a phishing campaign. The domain was registered on June 12 2026 through the Webflow registrar, a platform that provides hosted website services. DNS resolution points to the IP address 104.18.36.248, which is associated with Cloudflare’s content delivery network and is commonly leveraged by malicious operators to hide origin infrastructure. VirusTotal has recorded detections from 2 of 91 security vendors, confirming that at least a small subset of scanners consider the site malicious. The domain appears on a single external blocklist and has been explicitly flagged by the PhishDestroy service, which has taken it down from its own filtering feeds.

The risk rating is elevated and the operational status is listed as active, suggesting ongoing use. Publicly available intelligence does not include a page title, SSL certificate details, or HTTP response codes, limiting the ability to describe the exact content served. Consequently, the specific phishing lure (e.g., credential harvesting for a travel booking service) remains unverified. The limited detection footprint—only two vendor flags and one blocklist entry—may indicate that the site is relatively new or that detection signatures have not yet been widely deployed. Defenders should treat the domain as hostile.

Immediate mitigation steps include adding the domain and its resolving IP address 104.18.36.248 to outbound and inbound deny lists, updating DNS filtering policies to block the domain, and ensuring that any Webflow‑hosted assets are monitored for sudden changes. Continuous monitoring of VirusTotal, PhishDestroy, and other reputation sources is recommended to capture additional detections as they appear.