booking-ccom-dubaai-pacckagres[.]webflow[.]io

The domain booking-ccom-dubaai-pacckagres.webflow.io was registered on June 12, 2026 through the Webflow registrar. It resolves to the IPv4 address 172.64.151.8. VirusTotal has processed the host and 12 of 91 security vendors returned a malicious classification, indicating that the site is being used for malicious purposes. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service, reinforcing the suspicion of abuse. No additional metadata such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) tags are currently available for this host.

The lack of publicly visible page title or brand attribution means the specific target of the campaign cannot be confirmed at this time. Analysis of the infrastructure suggests that the attacker leveraged Webflow’s free hosting platform to publish a site that likely serves as a credential‑harvesting landing page, a common pattern for generic phishing campaigns. The recent creation date, combined with the rapid appearance on security blocklists, points to an opportunistic operation that is still in its early deployment phase. Because the IP address belongs to a shared hosting environment, the malicious content could be removed without affecting unrelated legitimate sites, but the subdomain itself remains a persistent indicator of compromise.

Defenders should add booking-ccom-dubaai-pacckagres.webflow.io to DNS and URL filtering policies, and consider blocking the associated IP 172.64.151.8 at the network perimeter. Monitoring for additional Webflow‑hosted subdomains that exhibit similar creation timestamps or that are flagged by multiple vendors can help identify related campaigns. Organizations should also educate users about unsolicited booking‑related communications and encourage verification of URLs before entering credentials.