bookingg--dubaihotel[.]webflow[.]io

The domain bookingg--dubaihotel.webflow.io was registered through the Webflow platform, a service that provides hosted website creation and automatically assigns Cloudflare‑based DNS. Network resolution points to the IP address 104.18.36.248, which is owned by Cloudflare and is commonly used for content delivery and proxy services. Analysis of public threat‑intel feeds shows that three of ninety‑one antivirus and URL‑reputation engines on VirusTotal have flagged the domain, indicating that at least a minority of security products have observed malicious behavior or content associated with it.

In addition, the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, which specializes in intercepting phishing‑related traffic. These independent detections suggest that the domain is being leveraged for credential‑theft operations, although the exact phishing template or targeted brand has not been disclosed in the available data. No public information about the site’s SSL certificate, HTTP response codes, or page title has been released, leaving the surface‑web characteristics of the site uncertain.

Defenders should therefore treat any traffic to bookingg--dubaihotel.webflow.io as hostile until further analysis clarifies its behavior. Recommended mitigation steps include adding the domain to network‑level deny lists, configuring proxy or DNS filters to block resolution to the associated Cloudflare IP range, and monitoring for any credential‑submission attempts that reference the domain. Continuous re‑evaluation is advised, as additional detection signatures or blocklist entries may emerge as the campaign evolves.