booking-com-duba-i-packag-es[.]webflow[.]io

The domain booking-com-duba-i-packag-es.webflow.io was created on 12 June 2026 and is hosted on Webflow’s shared infrastructure, resolving to the IP address 172.64.151.8, which is owned by Cloudflare and commonly used for Webflow sites. Threat intelligence indicates that the domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that it has already been observed in phishing campaigns.

VirusTotal analysis shows that 2 of 91 scanned security vendors flagged the domain, confirming that at least a minority of automated scanners consider it malicious. No additional data such as SSL certificate details, HTTP status codes, page title, or specific brand impersonation is available in the current intelligence set, leaving the exact content and lure tactics of the site unconfirmed.

Defenders should treat the domain as high‑confidence phishing infrastructure: network perimeter devices and DNS resolvers ought to block resolution of the domain and the associated IP, security monitoring should generate alerts on any outbound connections to the host, and existing detection rules should be updated to include the domain string. Continuous re‑inspection of the URL, especially if the site begins serving content, is recommended to refine the threat profile and to determine whether additional brand‑specific indicators emerge.