booking-com-dubai-things-todo[.]webflow[.]io

The domain booking-com-dubai-things-todo.webflow.io was registered on 12 June 2026 through the Webflow platform. DNS resolution points to the address 172.64.151.8, which is hosted on the Cloudflare edge network commonly used for legitimate web services. VirusTotal analysis shows that 2 of 91 scanned security vendors have flagged the domain as malicious, indicating that at least a minority of scanners recognize phishing‑related behavior. The domain is currently listed on a single external blocklist and has been actively blocked by the PhishDestroy service, confirming that threat‑intelligence feeds have identified it as a phishing vector.

No public Safe Browsing, OTX, or additional blocklist entries are reported, and there is no publicly available page title or SSL certificate fingerprint in the supplied data, leaving the exact content and certificate details unverified. The limited detection coverage suggests that the campaign may be newly deployed or using evasion techniques to avoid broader detection. Defenders should add the domain to local deny lists, enforce DNS sink‑hole policies for the IP 172.64.151.8, and monitor outbound traffic for connections to Webflow‑hosted endpoints that match this pattern.

Continuous re‑scanning with VirusTotal or comparable multi‑engine services is advised to capture any changes in detection status. Organizations that use corporate email or web gateways should ensure that phishing‑filtering rules include this exact domain, and incident response teams should treat any credential submission attempts to URLs under this host as compromised. Until further forensic analysis of the site content is available, the domain should be considered high‑risk for credential harvesting.