booking-com-dubai-restttttaurants[.]webflow[.]io

The domain booking-com-dubai-restttttaurants.webflow.io was registered on 12 June 2026 through the Webflow registrar and resolves to the IP address 172.64.151.8, which is part of the Cloudflare network. The domain has been added to one public security blocklist and is currently blocked by the PhishDestroy sinkhole, indicating that it is being actively used in malicious campaigns. VirusTotal analysis shows that two out of ninety‑one scanning engines have flagged the domain as malicious, providing additional corroboration of its hostile intent.

The combination of a recent registration date, use of a reputable hosting provider, and early detection by multiple security products aligns with the pattern of rapidly deployed phishing infrastructure that leverages trusted platforms to increase deliverability and reduce detection latency. No public information is available regarding the page title, SSL certificate details, or the exact content served by the site; consequently, the precise phishing vector and targeted brand cannot be confirmed beyond the implication of the domain name. Nevertheless, the observable indicators—registered via Webflow, hosted on Cloudflare, present on a blocklist, and flagged by VirusTotal—are sufficient for defenders to treat the domain as an active phishing threat.

Organizations should add the domain and its resolving IP to outbound and inbound filtering rules, monitor related DNS queries for the 172.64.151.0/24 block, and consider sharing the indicators with upstream threat feeds. Continuous re‑evaluation is advised, as additional malicious payloads or credential‑stealing pages may be deployed without further notice.