bookingcomdubai-hotels[.]webflow[.]io

On July 29 2026, threat analysts examined the domain bookingcomdubai-hotels.webflow.io, which was created on June 12 2026 and is hosted through Webflow’s free‑site service. DNS resolution points the domain to the IPv4 address 172.64.151.8. VirusTotal scanned the host and recorded detections from 2 of 91 security vendors, indicating that at least a minority of scanners recognize malicious behavior.

The domain appears on a single external blocklist and is actively blocked by the PhishDestroy filtering service, reinforcing the view that it is being used for malicious purposes. The risk rating assigned is elevated and the operational status is listed as active, suggesting ongoing exploitation. Concrete evidence beyond the infrastructure details is limited: no public information about the site’s SSL certificate, HTTP response codes, page title, or content has been disclosed, and no attribution to a specific phishing kit or brand is present in the available data.

Consequently, the precise payload or credential‑capture mechanism remains uncertain. Defenders should prioritize immediate mitigation by adding the domain to DNS‑based blocklists, configuring web‑gateway filters to deny traffic to the host, and monitoring outbound connections to the associated IP address. Continuous re‑evaluation is advised, especially if future scans reveal additional vendor detections or if content analysis surfaces new indicators of compromise.