bookingggcomdubaiirestaurants[.]webflow[.]io

Analysis indicates that the domain bookingggcomdubaiirestaurants.webflow.io was created on June 12, 2026 and is hosted on the Webflow platform. The domain resolves to the IP address 172.64.151.8, which is associated with Webflow’s shared hosting infrastructure. VirusTotal scans show that two of ninety‑one security vendors have flagged the domain as malicious, suggesting that at least a minority of detection engines have identified suspicious behavior.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming that it is being treated as a phishing‑related threat by at least one commercial mitigation provider. The limited detection count and blocklist presence imply that the campaign may be in an early stage or that the malicious payload is narrowly targeted, but the presence of any vendor detections underscores a non‑trivial risk. Defenders should add the domain and its resolving IP to network‑level deny lists, monitor outbound DNS queries for the domain, and ensure that endpoint protection solutions are updated to include the two vendor detections reported by VirusTotal.

Because the underlying Webflow hosting can host numerous legitimate sites, additional context such as traffic patterns or anomalous request volumes should be examined to differentiate benign Webflow traffic from malicious activity. The current intelligence does not reveal the specific content or credential‑collection mechanisms employed by the site; therefore, analysts should treat any interaction with the domain as potentially hostile and advise users to avoid providing any credentials or personal information. Continuous re‑evaluation is recommended, as further vendor detections or blocklist entries may emerge as the campaign evolves.