booking--com-dubei[.]webflow[.]io

The domain booking--com-dubei.webflow.io is currently flagged as an active generic phishing site with an elevated risk rating. Infrastructure analysis shows that the hostname resolves to the IP address 172.64.151.8, which belongs to the Webflow hosting platform; the registration record confirms that the domain was provisioned through Webflow. Detection data indicate that five of ninety‑one VirusTotal security vendors have raised alerts on the domain, and it is listed on a single external blocklist.

The phishing‑specific filtering service PhishDestroy has also recorded a block entry for this host, demonstrating that at least one dedicated anti‑phishing engine has identified malicious activity. No additional public intelligence such as Safe Browsing verdicts, Open Threat Exchange tags, or SSL certificate anomalies are presently available for this domain. Consequently, while the presence of vendor detections and blocklist entries provides concrete evidence of abuse, the limited scope of external reporting leaves the broader threat landscape unclear.

Defenders should proactively block DNS resolution to 172.64.151.8 and add the full hostname to web‑proxy deny lists. Monitoring of outbound traffic for attempts to contact this domain is recommended, and any internal users who report unexpected login prompts or credential‑submission pages that reference the domain should be instructed to abort the session and report the incident to the security team. Ongoing reconnaissance of the host, including periodic re‑scans on VirusTotal and checks against emerging blocklists, will help maintain situational awareness as the campaign evolves.