booking-com-dubei-things-to-doe[.]webflow[.]io

Analysis of the domain booking-com-dubei-things-to-doe.webflow.io shows concrete indicators of malicious use. The domain was created on 12 June 2026 and registered through the Webflow platform, a service that offers free website hosting and often supplies subdomains to users. DNS resolution points to IP address 172.64.151.8, an address associated with a large content‑delivery network that hosts many unrelated sites, making the hosting environment difficult to isolate. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one anti‑phishing engine has identified it as a phishing vector.

VirusTotal scans report that 2 out of 91 security vendors flagged the domain as malicious, providing independent confirmation that the site exhibits characteristics typical of phishing infrastructure. These detections, combined with the recent registration date, suggest a deliberate attempt to exploit the short‑lived domain for credential‑harvesting or similar attacks. Uncertainty remains regarding the specific payload or credential‑capture mechanisms employed because no page content, SSL details, or HTTP response codes are available in the current intelligence set.

Defenders should treat the domain as hostile: add the full host name to URL filtering rules, monitor DNS queries for repeated resolutions to 172.64.151.8, and consider blocking outbound connections to that IP where feasible. Endpoint protection products that reference VirusTotal detections can also be leveraged to raise alerts when the domain is accessed. Continuous re‑evaluation is advised, as additional security vendors may update their verdicts and further intelligence could reveal the exact phishing scenario in use.