bookingcomdubaiipackkages[.]webflow[.]io

The domain bookingcomdubaiipackkages.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. It is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, indicating that at least one security organization has observed malicious usage. VirusTotal analysis shows that 2 of 91 scanning engines flagged the domain, providing additional evidence of suspicious activity.

No public page title or content analysis is currently available, so the exact landing page structure and any credential‑harvesting components remain unknown. The hosting provider, Webflow, is a legitimate SaaS service, which can be abused to host malicious pages without obvious infrastructure footprints. Defenders should treat the domain as malicious and implement immediate blocking at network perimeter and endpoint filters.

The associated IP address 172.64.151.8 should be added to deny lists, and traffic to the Webflow sub‑domain pattern *.webflow.io should be scrutinized for anomalous request patterns. Continuous monitoring of threat intelligence feeds for further detections, and periodic re‑scans of the domain for updated vendor verdicts, are recommended to capture any evolution of the campaign.