booking--dubai--com[.]webflow[.]io

This domain, booking--dubai--com.webflow.io, is currently active and assessed as elevated risk. It was created on June 12, 2026, and is registered through Webflow. Analysis from July 29, 2026, shows that 15 out of 91 security vendors on VirusTotal flag this domain as malicious, indicating a broad consensus among detection engines. The domain resolves to IP address 104.18.36.248, which is associated with Cloudflare's content delivery network, a common hosting provider for legitimate and malicious sites alike. It appears on one security blocklist (PhishDestroy), confirming it has been identified by at least one threat intelligence source.

Google Safe Browsing, OTX, and additional trust scores were not provided in the known intelligence, so their status is uncertain. The exact page content and brand target are not yet analysed, but the domain name incorporates 'booking' and 'dubai', suggesting it may be attempting to impersonate a travel or booking service. Defenders should block this domain at the network level, monitor for any traffic or credential submissions, and add it to blocklists if not already present. Since the domain is hosted on Cloudflare, takedown may require coordination with the hosting provider and Webflow as the registrar.

Further investigation into the underlying content via direct access or sandbox analysis is recommended to confirm the specific phishing scheme. No evidence of SSL certificate details or HTTP status codes was provided. The domain's recent creation date (less than two months ago) combined with the high vendor detection rate supports an elevated risk classification. Defenders should treat this as an active threat and ensure no users have interacted with the site.