bookiinng-com-dubaaii[.]webflow[.]io[.]webflow[.]io

The domain bookiinng-com-dubaaii.webflow.io.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 104.18.36.248. Analysis by multiple threat‑intelligence sources flags the site as an active generic phishing operation with an elevated risk rating. VirusTotal has recorded detections from four of ninety‑one scanning engines, indicating that a subset of security vendors have identified malicious behavior associated with the domain. Independent blocklist aggregators confirm the domain’s presence on at least one security blocklist, and the phishing‑specific feed PhishDestroy has already listed the host as blocked, reinforcing the notion of ongoing malicious use.

Infrastructure assessment shows the domain is hosted on a shared Webflow CDN, a service commonly abused for short‑lived phishing sites because of its rapid provisioning and legitimate‑looking TLS certificates. The IP 104.18.36.248 belongs to the broader Cloudflare network, which provides generic CDN services but does not, by itself, imply benign intent. No additional evidence such as page titles, SSL certificate details, or HTTP response codes is currently available, so visual or content‑level verification remains pending.

Defenders should incorporate the domain into URL filtering rules and blocklist it across perimeter and endpoint controls. Continuous monitoring of the associated IP and any newly observed subdomains is advised, as threat actors often pivot to adjacent hostnames within the same hosting environment. Given the partial VirusTotal detections and existing blocklist entries, organizations are encouraged to treat any traffic to this domain as malicious and to investigate any internal logs that may contain connections to the IP 104.18.36.248 or the full hostname.