booking-com-dubbbaaai-shopping[.]webflow[.]io

The domain booking-com-dubbbaaai-shopping.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. DNS resolution points to the IPv4 address 104.18.36.248, which is associated with a shared content‑delivery infrastructure commonly used for legitimate web services. Despite the benign hosting context, the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating active abuse.

VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain as malicious, providing independent confirmation of its threat status. The limited detection count suggests that the site may be newly deployed or that detection signatures have not yet been widely propagated. No public SSL certificate details, HTTP response codes, or page title information are currently available, preventing a deeper content‑level assessment.

The lack of additional intelligence, such as brand impersonation or specific phishing kit identifiers, leaves the exact payload or lure unknown. Defenders should immediately add the domain to local deny lists, enforce DNS sinkholing, and monitor outbound traffic for connections to 104.18.36.248. Continuous re‑evaluation is advised, as additional detections or forensic artifacts may emerge as the campaign matures.