d2ggmm98h1as73d35ip0[.]bookingcomdubaihhotels[.]webflow[.]io

The domain d2ggmm98h1as73d35ip0.bookingcomdubaihhotels.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. Early detection activity places the domain on a single security blocklist and it is listed as blocked by the PhishDestroy service. VirusTotal analysis shows that three out of ninety‑one scanning engines have flagged the domain, indicating a modest but non‑trivial level of malicious confidence. No additional public blocklist entries, Safe Browsing alerts, or Open Threat Exchange (OTX) references have been observed for this indicator.

Infrastructure details such as the hosting IP address, autonomous system number, SSL certificate status, HTTP response codes, and site title remain undisclosed in the current intelligence set. Consequently, the precise hosting environment and any potential TLS weaknesses cannot be evaluated at this time. Defenders should add the domain to internal blocklists, enforce outbound DNS filtering, and monitor for any outbound connections to the underlying Webflow IP range. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in detection scores.

Network sensors should also watch for HTTP requests targeting the sub‑domain pattern *.webflow.io that match the observed domain string, as this may indicate active credential‑harvesting attempts. Organizations using Webflow for legitimate services should verify that the specific sub‑domain is not authorized, and if found unauthorized, request immediate takedown via the hosting provider. Ongoing threat‑intel feeds should be consulted for updates on detection counts, additional blocklist listings, or emerging evidence linking the domain to broader phishing campaigns.