bookingcomfordubai[.]webflow[.]io

The domain bookingcomfordubai.webflow.io is currently active and has been observed in multiple malicious‑infrastructure feeds. VirusTotal reports that eight of ninety‑one scanning engines have flagged the host, indicating a non‑trivial level of suspicion. The domain is listed on a public security blocklist and is actively blocked by the PhishDestroy filtering service, which further corroborates its association with phishing‑related activity. Registration metadata shows that the domain was created through the Webflow SaaS platform, a service commonly used for legitimate website hosting but also abused by threat actors to obtain fast‑deployment URLs.

DNS resolution points to the IP address 172.64.151.8; this address is part of the hosting infrastructure used by Webflow, providing no intrinsic reputation but confirming that the domain is reachable on the public Internet. Concrete evidence beyond the above indicators is not presently available. No public SSL/TLS certificate details, HTTP response codes, or page‑title information have been published in the supplied intelligence, leaving the exact content of the site unknown. Consequently, analysts cannot confirm the specific phishing lure or the credential‑harvesting mechanisms employed, only that the domain is being treated as malicious by multiple security products.

Given the existing detections, defenders should consider the domain high‑risk and enforce defensive controls. Recommended actions include adding bookingcomfordubai.webflow.io to URL filtering or DNS‑block lists, monitoring outbound connections to the resolved IP, and applying threat‑intelligence feeds that contain the domain. Organizations using Webflow‑based assets should verify that any internal usage of the platform is authorized, and auditors should review recent changes to DNS records for anomalies.