bookingcomhotels-dubai[.]webflow[.]io

On July 29, 2026 the domain bookingcomhotels-dubai.webflow.io was identified as an active generic phishing infrastructure. The domain resolves to the IP address 104.18.36.248, which is part of the hosting service used by Webflow. Registration information confirms the domain was provisioned through Webflow, indicating that the attacker leveraged a legitimate site‑building platform to obtain a trusted TLS certificate and stable hosting. The domain has been flagged by the PhishDestroy blocklist and is listed on one additional security blocklist, demonstrating that at least two independent threat‑intel sources have taken protective action.

VirusTotal analysis shows that 2 of 91 scanned security vendors have generated a detection for the domain, reinforcing the suspicion of malicious use while also indicating that the majority of scanners have not yet classified it as malicious. No public page title or brand targeting information is currently available, and the exact content served by the site has not been captured in the intelligence feed. Consequently, the precise phishing lure and victim‑targeting tactics remain uncertain.

Defenders are advised to add the domain and its resolved IP address to network‑level deny lists, monitor DNS queries for the domain, and consider extending existing URL filtering rules to include the associated blocklist identifiers. Continuous re‑evaluation of the domain on VirusTotal and other sandbox services is recommended, as additional detections may emerge. Because the infrastructure relies on a reputable hosting provider, any mitigation should be coordinated with the provider’s abuse‑handling process to expedite takedown.