aebooking-com-dubai-things-to-do[.]webflow[.]io

The domain aebooking-com-dubai-things-to-do.webflow.io was registered on 12 June 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. Within a month of its creation the domain appeared on a public security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that it is already being used in malicious campaigns. VirusTotal reports three positive detections out of ninety‑one submitted scanners, confirming that at least a subset of commercial security products have identified the site as suspicious.

The presence on a blocklist, the early detection by multiple vendors, and the short lifespan of the domain are consistent with a fast‑flux style phishing infrastructure that relies on newly registered, low‑reputation hosting. No additional metadata such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts were provided, so the current public evidence is limited to infrastructure and vendor signals. Defenders should immediately add the IP 172.64.151.8 to network‑level deny lists and block any DNS resolution for the full domain string.

Security information and event management (SIEM) rules should be updated to trigger alerts on outbound connections to this host, and proxy or web‑filter solutions should be configured to deny HTTP/HTTPS traffic to the domain. Continuous monitoring of the host’s activity is advised, as the underlying Webflow hosting may be reused for further malicious sites. Organizations that have observed credential‑theft attempts, especially those targeting travel‑related services, should verify that no credentials have been exfiltrated and consider forcing password resets for affected accounts.