booking-com-dubaai-tihings-to-do[.]webflow[.]io

Analysis of booking-com-dubaai-tihings-to-do.webflow.io indicates an active malicious infrastructure targeting users with a generic phishing campaign. The domain was registered on June 12, 2026 through the Webflow platform, a service commonly used for rapid site deployment, and currently resolves to the IPv4 address 172.64.151.8. Reputation checks show the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming its association with phishing activity. VirusTotal scans report that 2 of 91 security vendors have flagged the domain as malicious, providing independent corroboration of its threat status.

The elevated risk rating aligns with the observed detections and the presence on a dedicated anti‑phishing blocklist. No additional public intelligence such as SSL certificate details, HTTP response codes, or page title information is available at this time, limiting the depth of content‑level analysis. The limited detection footprint—only two vendor detections—suggests that the payload or lure may be newly deployed or that the site is employing evasion techniques that evade broader detection. The use of a Webflow‑hosted subdomain allows the operator to leverage a reputable hosting provider while obscuring the true command‑and‑control location.

Defenders should immediately add booking-com-dubaai-tihings-to-do.webflow.io to URL filtering and DNS block lists, and consider blocking the associated IP address 172.64.151.8 at the network perimeter. Continuous monitoring of the IP for any changes in hosting or additional domain registrations is advised. Given the active status, threat‑intel feeds should be updated to reflect the confirmed phishing nature of this domain, and any inbound traffic to the site should be logged and investigated for potential credential harvesting attempts.