grfhvwww[.]bookingcomfordubai[.]webflow[.]io

Analysis as of July 29 2026 indicates that the domain grfhvwww.bookingcomfordubai.webflow.io is actively used in a phishing campaign. The domain was registered on June 12 2026 through the Webflow platform, a service that provides hosting for user‑generated sites. DNS resolution points to the IP address 172.64.151.8, which is associated with the Cloudflare network and is shared among many unrelated legitimate sites. The domain appears on a single security blocklist and has been explicitly flagged by PhishDestroy, confirming that at least one trusted feed has observed malicious activity linked to this hostname. The hostname has been submitted to VirusTotal, where 91 antivirus and URL‑reputation vendors have examined the associated URL.

No vendor reported a detection at the time of scanning, but the absence of a positive result does not constitute evidence of benign intent, especially given the blocklist entry. The IP address 172.64.151.8 belongs to Cloudflare’s global edge network and is commonly used for content delivery, which can obscure the true origin of the payload. This shared infrastructure complicates attribution but does not mitigate the malicious intent indicated by the blocklist entry. No public information about the page title, SSL certificate details, HTTP response code, or content analysis is currently available, limiting the ability to describe the exact phishing lure or the credential‑capture mechanism. The domain name itself combines fragments of the legitimate brand “booking.com” with “dubai”, a pattern frequently observed in credential‑harvesting campaigns targeting travelers and hospitality customers.

Such homograph‑like constructions are typical of generic phishing operations that rely on user confusion rather than sophisticated malware delivery. Defenders should treat the domain as hostile. Recommended actions include adding the hostname to outbound and inbound web filtering rules, monitoring DNS queries for the IP 172.64.151.