bookingcommdubai[.]webflow[.]io

bookingcommdubai.webflow.io was registered through the Webflow platform on June 12, 2026. DNS resolution points to the IP address 172.64.151.8, which is known to host other Webflow‑hosted sites. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans have returned 11 positive detections out of 91 security vendors, indicating that multiple anti‑malware engines have identified malicious behavior associated with the domain.

The threat record carries a unique seed identifier 24899a, and the current status is marked as active, reinforcing the need for immediate mitigation. The risk level is elevated, reflecting both the detection count and the recent creation date, which suggests a fast‑tracked phishing infrastructure. No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, so the exact content and lure used by the phishing page remain unverified. Analysts should treat the domain as hostile infrastructure and add it to network‑level deny lists, endpoint URL filters, and email security gateways.

Monitoring traffic to 172.64.151.8 can help identify compromised clients, and any authentication attempts to the domain should be logged and investigated. Because the registrar is Webflow, defenders may also consider tightening controls on Webflow‑hosted subdomains to reduce the attack surface. Ongoing observation of the blocklist status and future VirusTotal scans is recommended to detect changes in detection prevalence.