bookingcomdubaiishoppiing[.]webflow[.]io

The domain bookingcomdubaiishoppiing.webflow.io is currently active and has been identified as a phishing campaign. Infrastructure analysis shows that the domain resolves to IP address 104.18.36.248, which is associated with the Webflow hosting platform. Registration data confirms the domain was created through Webflow, a legitimate website‑building service, indicating the attackers are leveraging a trusted SaaS environment to obscure malicious activity. VirusTotal scans have recorded detections by 2 of 91 security vendors, providing modest but concrete evidence that the domain is being flagged by threat intelligence sources.

Additionally, the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as malicious. The threat is marked as elevated risk and is listed as active, meaning it is presently reachable and may be used in ongoing phishing attempts. Because the public page title and content have not been analyzed, the exact lure or credential‑harvesting technique employed by the site remains uncertain. Defenders should therefore treat the domain as hostile regardless of the limited detection count.

Recommended mitigation steps include adding the domain to URL filtering rules, blocking the associated IP address at network perimeters, and monitoring for any outbound connections to the 104.18.36.248 address. Organizations using Webflow or similar SaaS platforms should increase scrutiny of newly registered subdomains, especially those that appear on blocklists or receive any vendor detections. Continuous re‑scanning with multiple engines and correlation with user‑reported phishing incidents will help refine the risk posture as further evidence becomes available.