demo[.]bookkingcoom--dubai[.]webflow[.]io

Analysis of demo.bookkingcoom--dubai.webflow.io indicates an active generic phishing infrastructure. The domain was registered on June 12 2026 via the Webflow platform and resolves to the IP address 172.64.151.8. VirusTotal reports that 3 of 91 scanning engines have flagged the domain, confirming malicious intent.

It is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the elevated risk classification. No additional public intelligence such as Safe Browsing, Open Threat Exchange, or SSL certificate details is currently available, and the page title or content has not been disclosed in the provided data set. The limited visibility means defenders cannot assess the exact payload or credential‑harvesting mechanisms employed, but the presence of multiple vendor detections and a dedicated blocklist entry suggests the domain is being used for phishing campaigns.

Defensive actions should include adding the domain to network deny lists, configuring DNS filtering to return NXDOMAIN or a sinkhole response, and monitoring outbound traffic for connections to 172.64.151.8. Continuous re‑inspection of the domain through threat‑intel platforms is advised, as additional indicators may emerge if the site becomes more widely distributed or if further analysis of the hosted content is performed.