booking-com-dubai-restttaurants[.]webflow[.]io

The domain booking-com-dubai-restttaurants.webflow.io was registered on 12 June 2026 through the Webflow platform, a service that provides hosted sub‑domains for website builders. DNS resolution points to the IP address 104.18.36.248, which belongs to the Cloudflare network and is commonly used for legitimate content delivery as well as for abuse. As of the report date 29 July 2026 the domain is listed as active and is classified as a generic phishing threat with an elevated risk rating. Multiple defensive feeds have observed the domain. PhishDestroy has already added it to its block list, and it appears on one additional security blocklist.

VirusTotal has recorded 13 positive detections out of 91 scanned scanners, indicating that a non‑trivial subset of security products consider the host malicious. No further public telemetry such as Safe Browsing or OTX entries is available in the current intelligence set. The short age of the domain—just over six weeks—combined with the use of a reputable hosting provider suggests a rapid deployment model typical of opportunistic phishing campaigns. The lack of publicly disclosed SSL certificate details, HTTP response codes, page title, or content analysis limits the ability to confirm the exact phishing lure or target brand.

Consequently, analysts cannot yet determine whether the site attempts credential harvesting for a specific travel service or employs a broader lure. Defenders should block or sinkhole the domain at network perimeters, update URL filtering rules to include the full host, and monitor for any outbound connections to the associated Cloudflare IP. Continuous re‑scanning on VirusTotal and inclusion in internal threat intel feeds are recommended to capture any change in detection posture.