static[.]bookingcomrestaurants-dubai[.]webflow[.]io

On July 29, 2026, static.bookingcomrestaurants-dubai.webflow.io was identified as an active generic phishing infrastructure with an elevated risk rating. The domain was created on June 12, 2026 and is registered through the Webflow platform, which provides hosting for user‑generated sites. DNS resolution points to the IPv4 address 172.64.151.8, a host that is currently associated with Webflow's content delivery network. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service, indicating that at least one anti‑phishing vendor has taken remediation action against it.

VirusTotal analysis shows that three of ninety‑one scanned security vendors flagged the domain, suggesting that a minority of scanners detected malicious behavior, though the majority did not raise an alert. The limited detection count, combined with the single blocklist entry, implies that the phishing campaign may be in an early deployment stage or that detection signatures have not yet fully converged on this specific pattern. Uncertainty remains regarding the exact payload delivered to victims, the presence of TLS certificates, and any additional hosting infrastructure beyond the primary IP address.

Defenders should prioritize adding the domain to internal blocklists, monitor DNS queries for the 172.64.151.8 address, and enforce email filtering rules that flag messages referencing Booking.com or restaurant services in the United Arab Emirates. Continuous re‑evaluation of VirusTotal and other sandbox feeds is recommended to capture any future changes in detection status. Organizations that rely on Booking.com communications should educate users about unsolicited requests for personal or payment information and verify URLs against official Booking.com domains before responding to any such solicitations.