booking-com-dubai-de-sert-saferi[.]webflow[.]io

The domain booking-com-dubai-de-sert-saferi.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. Security telemetry shows that the domain appears on a single blocklist and has been actively blocked by PhishDestroy, indicating that threat‑intel feeds have identified it as malicious. VirusTotal analysis reports that 2 of 91 scanned security vendors flagged the domain, which suggests that at least a subset of scanners recognize malicious payloads or behavior associated with the site. The limited number of detections may reflect a newly deployed phishing infrastructure that has not yet been widely observed.

The hosting provider, Webflow, typically supplies shared CDN and web‑hosting services, and the IP belongs to a network commonly used for legitimate content delivery, which can aid evasion. No public page title, SSL certificate details, or HTTP response codes are currently available, leaving the exact content and lure tactics unverified. Defenders should treat the domain as high‑confidence malicious based on blocklist inclusion and vendor detections.

Recommended actions include adding the domain to DNS‑level deny lists, configuring web‑proxy filters to block HTTP requests to the host, and monitoring outbound connections for the associated IP. Continuous re‑scanning with multi‑engine services is advised to capture any evolution in payloads, and any newly observed page metadata should be incorporated into detection rules. Organizations should also consider reviewing email gateway logs for references to the domain, especially in messages purporting to originate from Booking.com or related travel services, to mitigate credential‑harvesting attempts.