geyhfbookinngcomdubai[.]webflow[.]io

Analysis of geyhfbookinngcomdubai.webflow.io shows an active generic phishing infrastructure that was registered on June 12, 2026 and is hosted on the Webflow platform. The domain resolves to the IP address 172.64.151.8, which is owned by the Cloudflare network and is commonly used by abuse actors to hide their true origin. VirusTotal reports that 2 of 91 security vendors have flagged the domain, indicating that at least a minority of automated scanners have identified malicious characteristics. The domain is presently listed on the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least two independent threat‑intelligence feeds consider it malicious.

No public Safe Browsing, OTX, or other reputation services have been cited in the available intelligence, and the page title or any brand‑specific content has not been disclosed, leaving the exact lure or target brand unknown. Defenders should treat the domain as a high‑confidence indicator of phishing activity and block DNS resolution and HTTP traffic to the host. Network sensors should be tuned to flag any outbound connections to 172.64.151.8 from internal assets, especially those originating from email clients or web browsers. Email security gateways should add the domain to deny lists and enable URL rewriting to prevent end‑user navigation.

Continuous monitoring of the IP address for new hostnames and periodic re‑scanning with VirusTotal or equivalent sandbox services is advised to capture any evolution of the payload or additional malicious indicators. Because the underlying Webflow service can host legitimate content, additional context such as user‑agent patterns, request headers, and referrer data should be collected to differentiate benign traffic from malicious use. Until more detailed content analysis is available, the domain should be considered unsafe and excluded from all user‑facing communications.