webmail[.]booking-comaeu-dubai-restaurants[.]webflow[.]io

The domain webmail.booking-comaeu-dubai-restaurants.webflow.io was registered on June 12, 2026 through the Webflow hosting platform and resolves to the IP address 172.64.151.8. VirusTotal has recorded three detections out of ninety‑one security vendors, indicating that a minority of scanners have flagged the domain as malicious. Independent blocklist monitoring shows the domain appears on a single security blocklist and it has been explicitly blocked by the PhishDestroy mitigation service, confirming that at least one anti‑phishing organization considers the site malicious. No public SSL certificate information, HTTP response codes, or page title data are presently available, so the surface‑level characteristics of the web server remain unknown.

The limited detection footprint—three vendor flags and a single blocklist entry—suggests the infrastructure is either newly deployed or employing evasion techniques to avoid broader exposure. Defenders should prioritize adding the domain to outbound web‑filter deny lists and ensure that any email authentication mechanisms (DMARC, SPF, DKIM) are enforced for messages claiming to originate from the Booking.com brand. Network monitoring can be hardened by flagging traffic to 172.64.151.8, especially from internal users who may be targeted by credential‑harvesting campaigns.

Continuous re‑scanning on platforms such as VirusTotal is advisable to capture any escalation in detection counts. Because the domain is hosted on a shared Webflow environment, attribution to a specific threat actor is currently uncertain; threat intel teams should watch for other domains created around the same time that resolve to the same IP range. Until more concrete evidence emerges, the recommended mitigation is to block the domain at the DNS layer, monitor for related IOCs, and educate users about unsolicited communications that reference Booking.com services.