dubaii-bookingcom[.]webflow[.]io

Analysis dated July 29, 2026 identifies dubaii-bookingcom.webflow.io as an active generic phishing infrastructure. The domain was registered on June 12, 2026 via the Webflow platform, a service that commonly hosts user‑generated sites. DNS resolution points the domain to the IPv4 address 172.64.151.8, an IP range associated with a public cloud provider, indicating that the attacker leveraged a shared hosting environment to conceal activity.

VirusTotal records show that three out of ninety‑one scanning engines have raised detections against the domain, suggesting the presence of malicious payloads or phishing‑related indicators recognized by a minority of security products. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy filtering service, confirming that at least one threat‑intelligence feed has catalogued it as hostile. No additional technical artefacts such as SSL certificates, HTTP response codes, or page titles are available in the current intelligence set, leaving the visual or functional characteristics of the hosted page unverified.

Consequently, the exact brand or service being spoofed remains unknown, and the specific phishing vector cannot be described beyond the generic classification. Defenders should add 172.64.151.8 to deny‑list rules, enforce domain‑level blocking for dubaii-bookingcom.webflow.io across perimeter and endpoint filters, and monitor DNS queries for similar Webflow‑hosted subdomains created after June 2026. Continuous re‑scanning with multi‑engine platforms is recommended to capture any evolution in the payload, and any future detection spikes should be correlated with traffic logs to assess potential compromise attempts.