dubaibybookingcom[.]webflow[.]io

Analysis of dubaibybookingcom.webflow.io indicates that the domain was registered on June 12 2026 through the Webflow platform, a service commonly used for rapid website deployment. The domain resolves to the IP address 172.64.151.8, an address owned by Cloudflare’s network, which provides generic CDN and DDoS mitigation services. This hosting choice is typical for malicious operators seeking to hide origin and benefit from shared reputation. VirusTotal scans have reported six detections out of ninety‑one submitted security engines, confirming that multiple AV products recognize the site as malicious.

The domain is listed on a public security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing its classification as a phishing vector. No public page title or content snapshot is presently available, so the exact visual or credential‑harvesting tactics remain unverified. The limited age of the domain—less than two months at the time of this report—suggests a fast‑flux or opportunistic campaign that leverages newly created sites to evade long‑term reputation filters.

Defenders should incorporate the IP address 172.64.151.8 and the domain name into DNS and web‑proxy blacklists, monitor for outbound connections to the associated Cloudflare edge, and enforce URL filtering based on the known blocklist entries. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution in payload or hosting. Until further forensic detail is obtained, the precautionary stance is to treat any traffic to dubaibybookingcom.webflow.io as hostile.