bookinggcommdubaiihotels[.]webflow[.]io

Analysis of bookinggcommdubaiihotels.webflow.io shows the domain was registered on June 12, 2026 through Webflow’s hosting platform. The domain resolves to the IP address 172.64.151.8, which is part of the Cloudflare network used by many Webflow sites. VirusTotal scans have reported that 2 of 91 security vendors classify the domain as malicious, indicating that at least two independent engines have identified suspicious behavior. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy feed, confirming its presence in threat intelligence sources.

The risk rating assigned is elevated and the operational status is active as of the report date, July 29, 2026. No public SSL certificate details, HTTP response codes, or page title information are available in the current intelligence set, leaving the exact content and user‑facing behavior unverified. Consequently, the precise phishing technique employed (e.g., credential harvesting, credential‑stealing login page) cannot be confirmed without further payload analysis. However, the combination of a recently created Webflow sub‑domain, a modest but non‑zero detection count, and inclusion on a phishing‑specific blocklist strongly suggests the domain is being used for a generic phishing campaign.

Defenders should add 172.64.151.8 to egress and ingress filtering rules, block the fully qualified domain name, and monitor DNS queries for look‑alike variations. Continuous re‑scanning on VirusTotal or similar multi‑engine services is recommended to capture any escalation in detection counts. Organizations employing web‑filtering solutions should ensure the domain is listed in their URL deny lists, and endpoint protection platforms should be configured to flag any network connections to the IP address. Ongoing threat‑intel correlation with other Webflow‑hosted domains may reveal additional infrastructure reuse.