bookingcomdubaithingstoo-do[.]webflow[.]io

Analysis of the domain bookingcomdubaithingstoo-do.webflow.io indicates active malicious activity classified as generic phishing. The site was registered on June 12, 2026 through the Webflow platform, a service commonly used for rapid site deployment. Infrastructure inspection shows the domain resolves to the IP address 172.64.151.8, which is hosted on a cloud‑based network and does not immediately reveal a dedicated command‑and‑control infrastructure.

The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one trusted mitigation source has taken action against it. VirusTotal scans report that two of ninety‑one participating security vendors have flagged the domain, providing independent confirmation of malicious intent despite the relatively low detection count. No additional data such as Safe Browsing verdicts, Open Threat Exchange entries, SSL certificate details, HTTP response codes, trust‑score metrics, page titles, or evidence URLs are presently available, leaving those vectors unverified.

Defenders should prioritize adding the domain to local deny lists and ensure that network‑level egress filtering blocks connections to 172.64.151.8. Monitoring for new indicators, especially any changes in detection counts on VirusTotal or additional blocklist listings, is recommended to capture evolving threat posture. Organizations using Webflow for legitimate services should review any similar subdomains for unauthorized use, and security teams should maintain heightened alertness for phishing campaigns targeting users with URLs that mimic reputable brand naming patterns.