bookinggcomdubairestaurants[.]webflow[.]io

On 12 June 2026 a sub‑domain bookinggcomdubairestaurants.webflow.io was registered through the Webflow platform. The domain resolves to the IP address 172.64.151.8, which is part of Cloudflare’s network and is commonly used for hosting short‑lived malicious pages. VirusTotal scans recorded two detections out of 91 security vendors, indicating that at least a small subset of scanners have identified malicious behaviour associated with the host.

The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the assessment that the infrastructure is being used for phishing‑related activity. No additional public intelligence such as Safe Browsing alerts, OTX mentions, or SSL certificate details were observed at the time of analysis. The limited detection count and single blocklist entry suggest that the campaign may be in an early stage or employing a fast‑flux approach to evade broader detection.

Defenders should add the domain and its resolving IP to outbound and inbound network filters, monitor DNS queries for the host, and consider sharing indicators of compromise with upstream threat‑sharing platforms. Continuous re‑scanning with VirusTotal and periodic checks of blocklist status are recommended to capture any escalation in detection rates.