d2ggmap8h1as73d2r9r0[.]boooking--ccom-duubai[.]webflow[.]io

This domain, d2ggmap8h1as73d2r9r0.boooking--ccom-duubai.webflow.io, is actively flagged as an elevated-risk generic phishing threat targeting users through a likely spoofed booking or travel-related service. Registered on June 12, 2026, via Webflow, the domain resolves to IP address 172.64.151.8, a Cloudflare-hosted endpoint commonly used to mask origin infrastructure. As of July 29, 2026, the domain appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis indicates that 3 of 91 security vendors have flagged the domain, though the exact detection rationale remains unconfirmed due to limited public reporting.

Infrastructure analysis reveals the domain leverages Webflow’s hosting platform, which is frequently exploited for rapid deployment of phishing pages due to its ease of use and built-in SSL certificates. The domain name itself contains deliberate misspellings ('boooking', 'ccom', 'duubai'), a common tactic to evade brand-based filters while appearing visually similar to legitimate booking services. No specific page title, brand target, or phishing kit has been publicly attributed to this domain at the time of assessment, and the exact content of the site remains unanalysed. Defenders should treat this domain as an active threat.

The combination of a newly registered domain, Cloudflare IP resolution, blocklist presence, and vendor detections on VirusTotal warrants immediate blocking at the DNS or proxy level. Security teams are advised to monitor for related domains using similar misspelling patterns or Webflow hosting, as these may indicate a broader campaign. Further investigation into the domain’s HTTP response headers, SSL certificate details, and any linked JavaScript resources could provide additional indicators of compromise. Given the elevated risk classification, user warnings or automated takedown requests to Webflow may be appropriate.