bookinggcomdubaithingstodo[.]webflow[.]io

Analysis of the domain bookinggcomdubaithingstodo.webflow.io indicates it is actively serving phishing content targeting users of travel or booking services. Registered through Webflow, the domain resolves to IP address 172.64.151.8, which is part of an infrastructure commonly used for both legitimate and malicious hosting. As of July 29, 2026, two of 91 security vendors on VirusTotal have flagged this domain, suggesting early but limited detection. The domain appears on one security blocklist and is blocked by PhishDestroy, reinforcing its classification as a phishing threat.

No specific brand name or scam type is confirmed in the available data, though the domain name suggests an attempt to mimic travel or activity booking platforms, particularly those associated with Dubai. The exact content of the site has not been analyzed, so the precise nature of the phishing lure—whether credential harvesting, payment fraud, or another scheme—remains uncertain. The use of Webflow as a hosting platform is notable, as it allows rapid deployment of sites with minimal technical barriers, a tactic frequently exploited by threat actors to evade initial scrutiny. Defenders should treat this domain as an active phishing threat.

Network-level blocking is recommended, particularly for organizations in the travel, hospitality, or e-commerce sectors. Security teams should monitor for connections to 172.64.151.8 and correlate logs for any user interactions with bookinggcomdubaithingstodo.webflow.io. Given the limited detection coverage, additional analysis—such as sandboxing or manual review—may be warranted to determine the full scope of the threat. No SSL or HTTP status anomalies were reported in the available data, but this does not preclude the presence of malicious content.