bookingddubairestaurants[.]webflow[.]io[.]webflow[.]io

Analysis indicates that bookingddubairestaurants.webflow.io.webflow.io is an active phishing domain targeting users through fraudulent booking or reservation services. The domain was registered on June 12, 2026, via Webflow, a platform commonly used for both legitimate and malicious web projects. Infrastructure analysis reveals the domain resolves to the IP address 172.64.151.8, which is associated with hosting providers frequently utilized in phishing campaigns. At the time of this report, the domain appears on one security blocklist and is blocked by PhishDestroy, a specialized anti-phishing service.

VirusTotal telemetry shows that three out of ninety-one security vendors flag the domain as malicious, though the specific detection signatures and classifications remain unreported. The domain's structure, including the redundant 'webflow.io.webflow.io' subdomain pattern, is atypical for legitimate services and may indicate an attempt to exploit automated trust in the Webflow brand. No brand target or phishing kit has been explicitly identified in the available intelligence, and the exact content of the site has not been analyzed. The risk level is classified as elevated due to its presence on blocklists and vendor detections, though the limited number of flags suggests the campaign may still be in an early or targeted phase.

Defenders should treat this domain as untrustworthy and prioritize blocking it at the network and endpoint levels. Organizations using Webflow for legitimate purposes should monitor for similar subdomain patterns or newly registered domains under their control. Further investigation is recommended to determine the full scope of the campaign, including any associated email or SMS distribution vectors. If additional telemetry becomes available, such as payload analysis or victim reports, the domain's classification may be refined.