booking-com-dubbai-restaurrants[.]webflow[.]io

Analysis as of July 29 2026 indicates that booking-com-dubbai-restaurrants.webflow.io is actively used for phishing. The domain was registered on June 12 2026 through the Webflow platform, a service that provides hosted site building and CDN. DNS resolution points to the IP address 172.64.151.8, which belongs to the Cloudflare network and is commonly leveraged for rapid deployment of malicious pages. VirusTotal has recorded detections from 2 of 91 security vendors, confirming that at least a small subset of scanners have identified malicious behavior linked to the host. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, reinforcing the assessment of phishing activity.

The risk level is classified as elevated and the status remains active, meaning the site continues to resolve and can be accessed by end‑users. Concrete evidence is limited to the registration metadata, IP ownership, and the two vendor detections. No public page title, SSL certificate details, or HTTP response codes are currently available, preventing a deeper content‑based analysis. Likewise, no references from OTX, Google Safe Browsing, or additional blocklists have been observed. Consequently, the confidence in the phishing classification relies on the observed infrastructure signals and the existing blocklist entries.

Defenders should immediately block or sinkhole the domain at network perimeter controls and add the associated IP address to hostile‑IP lists. Continuous monitoring of the IP and any newly observed subdomains is advised, as the hosting provider may generate additional malicious sites from the same address space. Periodic rescanning of the domain on multi‑engine services such as VirusTotal is recommended to capture any emerging detections. Organizations that receive suspicious emails referencing travel or restaurant reservations should treat any link to this domain as malicious and instruct users to avoid interaction.