bookinngccomdubaishopping[.]webflow[.]io

Analysis of the domain bookinngccomdubaishopping.webflow.io shows a newly created web‑hosting asset that is actively being leveraged for phishing. The domain was registered on June 12, 2026 through the Webflow service, which is a legitimate website‑builder platform often abused by threat actors to obtain disposable hosting. DNS resolution points to the IP address 172.64.151.8, a cloud‑based endpoint that does not directly reveal a dedicated malicious infrastructure but provides the necessary web presence for the campaign. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, indicating that at least one anti‑phishing feed has identified malicious activity associated with the host.

VirusTotal scans report that two of ninety‑one security vendors flagged the domain, reinforcing the suspicion that the site is being used for malicious purposes, though the majority of scanners have not yet raised an alert. The risk level is elevated and the status is marked as active, suggesting ongoing operation. While the current evidence confirms the domain’s involvement in generic phishing, details such as the exact phishing payload, targeted brand, or page content remain unverified because no page title or further content analysis is available.

Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP, and consider extending detection rules to encompass any subdomains that resolve to the same host. Because the registrar is a widely used public service, takedown requests may be less effective, so rapid network‑level containment is recommended. Continuous re‑scanning on platforms like VirusTotal is advised to capture additional vendor detections as the campaign evolves.