bookingcomthingstodo-dubai[.]webflow[.]io

Analysis of bookingcomthingstodo-dubai.webflow.io shows a newly registered domain (creation date 12 June 2026) that is already listed on a security blocklist. The domain is hosted on Webflow’s infrastructure and resolves to IP address 172.64.151.8, an address belonging to the Cloudflare network often leveraged for content delivery and site hosting. PhishDestroy has actively blocked the domain, indicating that it was detected as part of a phishing campaign.

VirusTotal scans have returned two positive detections out of 91 security vendors, confirming that at least a subset of anti‑malware engines consider the domain malicious. No additional data such as SSL certificate details, HTTP response codes, page title, or brand targeting have been disclosed, so the precise phishing lure (e.g., credential harvesting, payment redirection) remains unverified.

Defenders should treat the domain as hostile: add the fully qualified domain name to network and endpoint blocklists, monitor traffic to the associated IP for anomalous patterns, and consider extending detection rules to cover any sub‑domains that may be created under the same Webflow account. Continuous re‑evaluation is advised, as the threat actor could modify the site content or launch new campaigns using the same hosting provider.