bbooking---comdubai[.]webflow[.]io

This domain, bbooking---comdubai.webflow.io, was registered through the Webflow platform on June 12, 2026. The domain resolves to the IPv4 address 172.64.151.8, which is associated with Webflow’s shared hosting infrastructure. An early blocklist entry indicates that the domain is already listed on a security blocklist, and PhishDestroy has actively blocked it. VirusTotal analysis shows that 15 of 91 security vendors submitted a detection for the domain, confirming that a notable portion of automated scanners consider it malicious. The presence of multiple vendor detections, combined with the blocklist listing, suggests that the domain is being used for a phishing campaign, consistent with the generic phishing threat type assigned.

Infrastructure analysis reveals no distinct autonomous system or dedicated hosting; the IP belongs to a range commonly used for legitimate Webflow sites, which can make detection based solely on IP less reliable. The registrar information points to Webflow as the registrar, implying that the domain benefits from the platform’s rapid deployment capabilities, a factor often leveraged by threat actors to host short‑lived phishing pages. No additional data such as SSL certificate details, HTTP response codes, page titles, or brand references are currently available, leaving those vectors unverified. Defenders should prioritize immediate blocking of the domain and the associated IP address in perimeter and DNS filtering solutions.

Continuous monitoring of Webflow‑hosted subdomains is recommended, as similar phishing infrastructure may be spun up using the same service. Updating intrusion detection signatures to include the observed domain pattern and incorporating the 15 vendor detections into threat intel feeds will improve early warning. Because the domain’s hosting environment is shared, any future malicious pages may appear under the same IP, so correlation of traffic to 172.64.151.8 with other suspicious activity is advised.