bokingcomdubaii[.]webflow[.]io

Analysis of bokingcomdubaii.webflow.io indicates active malicious activity targeting users with a generic phishing campaign. The domain is registered through Webflow, a legitimate website‑building platform, and resolves to the IP address 172.64.151.8, which is part of Webflow’s hosting infrastructure. The site has been blocked by the PhishDestroy sinkhole and appears on a single security blocklist, confirming that at least one external defensive feed has identified it as hostile.

VirusTotal scans show that 5 of 91 security vendors have flagged the domain, providing independent corroboration of its malicious nature. The current risk rating is elevated, and the status remains active as of the report date, July 29 2026. No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or brand targeting is available, leaving the exact phishing vector and payload undisclosed.

Defenders should immediately add the domain and its resolving IP to network‑level deny lists and update endpoint protection signatures to include the observed indicators. Monitoring outbound DNS queries for the domain and correlating any internal user clicks with the listed blocklist entry will aid in detecting attempted compromises. Continuous re‑evaluation is advised, as further enrichment (e.g., page content analysis or additional blocklist listings) may surface new tactics or affected brands.