bookingcomdubaishoppingg[.]webflow[.]io

Analysis as of July 29, 2026 indicates that the domain bookingcomdubaishoppingg.webflow.io is actively used for a generic phishing campaign and is classified at an elevated risk level. The domain was registered on June 12, 2026 through the Webflow service, a platform that provides hosted web content. DNS resolution points to the IPv4 address 172.64.151.8, which is consistent with Webflow’s infrastructure. Independent testing on VirusTotal shows that 2 of 91 security vendors have raised a detection on the domain, confirming malicious intent despite the low overall detection count.

The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing the assessment of malicious activity. No additional public threat intelligence such as Safe Browsing alerts, OTX reports, or SSL certificate telemetry is presently available for this host. Because the site’s page title, content, and any target brand references have not been disclosed, the precise phishing vector (e.g., credential harvesting for a specific service) remains unverified.

Defenders should immediately add bookingcomdubaishoppingg.webflow.io to network and endpoint blocklists, enforce DNS sink‑hole rules for the associated IP, and monitor outbound traffic for connections to the host. Continuous re‑scanning with multi‑vendor engines is recommended to capture any future changes in detection status. Given the recent creation date and active hosting, the domain should be treated as a live threat vector until takedown or remediation is confirmed.