booking-ceom-dubaei-thinges-todeo[.]webflow[.]io

Analysis of the domain booking-ceom-dubaei-thinges-todeo.webflow.io indicates an active phishing infrastructure registered through Webflow and resolving to IP address 104.18.36.248 as of July 29, 2026. The domain appears on one security blocklist and is flagged by 17 of 91 security vendors on VirusTotal, suggesting elevated risk. No specific brand target or phishing kit details are currently confirmed in available intelligence, and the exact content of the site remains unanalyzed.

Infrastructure analysis reveals the domain is hosted on Webflow’s platform, which is commonly exploited for rapid phishing deployment due to its ease of use and free tier availability. The IP address 104.18.36.248 is part of a shared hosting environment, limiting attribution to a specific threat actor but indicating potential for further malicious subdomains under the same infrastructure. Defenders should treat this domain as an active phishing threat, particularly given its detection by multiple security vendors and presence on blocklists.

Organizations are advised to block the domain at the network level and monitor for related subdomains or IP-based indicators. Further investigation into the page content and potential brand impersonation is recommended to determine the exact nature of the phishing campaign.