bookingcomdubai-restaurants[.]webflow[.]io[.]webflow[.]io

The domain bookingcomdubai-restaurants.webflow.io.webflow.io was created on 12 June 2026 and is hosted through the Webflow website‑building platform. It is currently listed as active with an elevated risk rating and is classified as a generic phishing infrastructure. The domain has been added to the PhishDestroy blocklist and appears on one additional security blocklist, indicating that at least one defensive feed has identified it as malicious.

VirusTotal analysis shows that three out of ninety‑one antivirus engines flag the domain, providing limited but corroborating evidence of malicious activity. No further public intelligence such as Safe Browsing alerts, Open Threat Exchange entries, ASN, geolocation, SSL certificate details, HTTP response codes, or page‑title metadata is available at this time. Consequently, the precise hosting IP, content served, and any credential‑harvesting mechanisms remain unverified.

The combination of recent registration, association with a legitimate hosting service, and multiple vendor detections suggests a purposeful attempt to exploit the brand‑related sub‑domain for phishing. Defenders should add the full domain to network and endpoint blocklists, monitor DNS queries for lookups, and consider restricting outbound connections to the Webflow hosting range pending further investigation. Continuous re‑evaluation is advised, as additional indicators such as payload samples or URL redirects may emerge from future scans.