bookingcomdubaiishopping[.]webflow[.]io

The domain bookingcomdubaiishopping.webflow.io was created on 12 June 2026 and is hosted on the Webflow platform, as indicated by the registrar information. It resolves to the IP address 104.18.36.248, a range commonly associated with content‑delivery services that can hide the true backend infrastructure. Threat intelligence sources have marked the domain as active with an elevated risk rating. PhishDestroy has already added the domain to its blocklist, and it appears on an additional security blocklist, confirming that at least one external repository is flagging it.

VirusTotal analysis shows that 2 of 91 scanned security vendors returned a positive detection for malicious behavior, providing independent corroboration of the phishing classification. The limited detection count suggests a relatively new or low‑profile campaign, but the presence of any detections together with blocklist entries warrants immediate attention. No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, and no further forensic artefacts such as OTX tags or brand‑specific lure content have been disclosed. Consequently, defenders cannot confirm the exact phishing lure or the credential‑harvesting techniques employed, only that the domain is being used for generic phishing attempts.

Given the current evidence, security teams should proactively block the domain at network perimeter devices, update DNS filtering rules to include the IP address 104.18.36.248, and add the domain to internal blocklists. Email gateways should be configured to reject any messages containing links to this domain, and endpoint protection solutions should be instructed to flag any outbound connections to the host. Continuous monitoring of the IP range and periodic re‑scans with VirusTotal are recommended to detect any escalation in detection counts or new payloads associated with the domain.