booking--com--dubai[.]webflow[.]io[.]webflow[.]io

The domain booking--com--dubai.webflow.io.webflow.io was registered on 12 June 2026 through the Webflow platform. Infrastructure analysis shows the hostname resolves to the IP address 104.18.36.248, which is a Cloudflare‑owned address commonly used for content delivery. VirusTotal has recorded three positive detections out of ninety‑one scanned vendors, indicating that a minority of security products have flagged the domain for malicious behavior. The domain is currently listed on one external security blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing feed considers it a threat.

The risk rating assigned to the indicator is elevated and the operational status is marked as active, meaning the site is still reachable and may be used in ongoing campaigns. Publicly available intelligence does not include a page title, SSL certificate details, or HTTP response codes, so the visual content and transport security of the site remain unverified. Consequently, the exact phishing narrative, targeted brand, or credential‑stealing mechanism cannot be confirmed at this time.

Analysts should treat the domain as a probable generic phishing host until further evidence is gathered. Defensive recommendations include adding the fully qualified domain name and its resolving IP address to network‑level deny lists, updating web‑proxy and secure‑web‑gateway filters to block any HTTP(S) requests to the host, and monitoring for any future VirusTotal or threat‑intel updates that might increase the detection count. Continuous observation of the associated IP for anomalous traffic patterns is also advised, given its shared hosting environment on a popular CDN provider.