booking---com-dubai[.]webflow[.]io

Analysis as of July 29, 2026 indicates that the domain booking---com-dubai.webflow.io was registered on June 12, 2026 via the Webflow hosting platform and resolves to the IP address 172.64.151.8. The domain is currently listed as active and assigned an elevated risk level. It has been added to one public security blocklist and is specifically blocked by the PhishDestroy service. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, confirming a detection by at least two independent scanners.

The presence of the domain on a blocklist, its registration through a free-form site builder, and the limited but positive VirusTotal detections collectively suggest that the infrastructure is being used for a generic phishing campaign. The creation date of June 12, 2026 places the domain less than two months old at the time of reporting, a characteristic often observed in fast-flux or disposable phishing infrastructure. The fact that the domain is hosted on Webflow, a platform commonly used for legitimate website publishing, may allow it to bypass basic reputation checks that focus on traditional registrars. However, the combination of blocklist inclusion, PhishDestroy detection, and the two vendor flags on VirusTotal provide sufficient confidence to classify the host as malicious.

No evidence of legitimate business use, SSL certificates, or benign traffic patterns has been observed. Security teams should also consider correlating internal proxy or email gateway logs for any URLs containing the domain string, as phishing attempts frequently distribute malicious links via email or messaging platforms. Immediate containment actions—such as network-level blocking, endpoint URL filtering, and user awareness alerts—are recommended to reduce exposure while further investigation continues.