bookingcomdubain[.]webflow[.]io

bookingcomdubain.webflow.io is currently listed as an active phishing‑related infrastructure. The domain was provisioned through the Webflow SaaS platform, which is commonly used for rapid website deployment and can be abused for malicious hosting. DNS resolution points to the IP address 104.18.36.248, an address owned by Cloudflare’s network, indicating that the site is being served behind a CDN that masks the true origin server.

The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing service has observed malicious activity associated with it. VirusTotal analysis shows that four of ninety‑one AV engines have flagged the domain, providing additional independent corroboration of its suspicious nature. No further details such as SSL certificate parameters, HTTP response codes, or page title have been disclosed, leaving the exact payload or credential‑capture mechanism unknown.

Given the convergence of registration data, blocklist presence, and multi‑vendor detections, defenders should treat the domain as hostile. Recommended mitigation steps include adding the domain to network‑level deny lists, configuring web‑gateway filters to drop traffic to 104.18.36.248 when associated with this hostname, and monitoring DNS queries for repeat look‑ups. Continuous re‑evaluation is advised, as additional intelligence—such as content analysis or further vendor detections—may emerge.