booking-com-dubai-hotel[.]webflow[.]io

booking-com-dubai-hotel.webflow.io is a newly registered domain (created 12 June 2026) that leverages Webflow’s hosting platform. DNS resolution points to IP 104.18.36.248, an address owned by Cloudflare, indicating the site is served through a content delivery network rather than a dedicated server. The domain appears on a single security blocklist and is listed by PhishDestroy as a malicious site. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain as malicious, providing limited but corroborating evidence of abuse.

No additional public intelligence such as OTX or Safe Browsing entries is currently available. The brief age of the domain, coupled with its use of a reputable hosting service, is a common pattern for phishing operators seeking to benefit from the perceived legitimacy of the platform while obscuring the true backend. Defenders should add the fully qualified domain to URL filtering rules, enforce TLS inspection to observe any credential‑submission traffic, and monitor outbound connections to the associated IP.

Continuous re‑scanning with multi‑engine services is advised, as further detections may emerge. Organizations that regularly interact with Booking.com services should educate users about unexpected login prompts and verify URLs before entering credentials. The limited detection count suggests the campaign may be in early stages, but the presence on a dedicated phishing blocklist warrants elevated vigilance.