cdcxrdubaithingstodobookingcom[.]webflow[.]io

Analysis of cdcxrdubaithingstodobookingcom.webflow.io indicates active malicious infrastructure supporting a generic phishing campaign. The domain was registered on June 12, 2026 through the Webflow hosting platform, a service commonly abused for rapid deployment of fraudulent sites. DNS resolution points to the IP address 172.64.151.8, which is hosted on the Cloudflare network and does not appear to be associated with the legitimate Webflow customer base. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one trusted source has observed malicious use.

VirusTotal analysis shows that 2 of 91 security vendors flagged the domain, providing independent corroboration of its risk profile. The elevated risk rating aligns with this limited but consistent detection. No additional public intelligence such as Safe Browsing entries, Open Threat Exchange records, or SSL certificate details are currently available for this host, and the page title has not been disclosed in the source data. Given the recent creation date, active blocklist presence, and vendor detections, defenders should treat the domain as hostile.

Recommended mitigations include adding the domain to DNS deny lists, updating web proxy and firewall rules to block HTTP and HTTPS traffic to the host, and monitoring for any outbound connections to the IP address 172.64.151.8. Organizations should also audit email filters for messages containing URLs that reference the “cdcxrdubaithingstodobookingcom.webflow.io” pattern, as the domain name appears designed to mimic legitimate booking services. Continuous re‑evaluation is advised, as additional detections or content analysis may emerge.