booking-com---dubai[.]webflow[.]io

The domain booking-com---dubai.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 104.18.36.248. VirusTotal has recorded two detections out of ninety‑one scanned security vendors, indicating that at least a small subset of scanners have identified malicious characteristics associated with the domain. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, further confirming its classification as a phishing resource.

No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange (OTX) tags, or SSL certificate details are currently available for this host. The limited detection count suggests that the phishing infrastructure may be newly deployed or employing techniques that evade broader detection. Infrastructure analysis shows the domain is hosted on a shared CDN address (104.18.36.248) commonly used by many legitimate Webflow sites, which can obscure attribution and increase the difficulty of takedown actions.

Because the page title and visual content have not been disclosed, the specific brand or service being spoofed cannot be verified; consequently, the report classifies the activity as generic phishing. Defenders should block the domain at network perimeters, add it to local deny lists, and monitor outbound connections to the associated IP for anomalous traffic. Continuous re‑scanning with multi‑vendor engines is advised to capture any escalation in detection rates, and security teams should consider sharing any newly observed indicators of compromise with threat‑sharing communities to improve collective visibility.