dubaihotelsbooking-com[.]webflow[.]io

The domain dubaihotelsbooking-com.webflow.io was created on 12 June 2026 and registered through the Webflow platform, indicating that the attacker leveraged a legitimate web‑hosting service to obtain a functional URL. DNS resolution for the domain returns the address 172.64.151.8, an IP that is associated with a widely used content‑delivery network, providing the attacker with fast, globally distributed hosting and obscuring the true origin of the site. VirusTotal analysis shows that two of ninety‑one antivirus and URL‑reputation engines flagged the domain as malicious, suggesting that at least a small subset of security products have identified suspicious activity linked to the URL.

The domain is actively listed by PhishDestroy and appears on one additional security blocklist, confirming that external threat‑intelligence feeds consider it a phishing‑related indicator. No publicly available information about the site’s SSL certificate, HTTP status code, page title, or content has been disclosed, leaving the specific phishing payload and targeted brand unverified. Consequently, the precise phishing scenario (e.g., credential harvesting, payment diversion) remains uncertain.

Defenders are advised to block the domain at network perimeter devices, add the IP address 172.64.151.8 to host‑based deny lists, and monitor for outbound connections to the associated CDN range. Further dynamic analysis of the landing page, including content capture and credential‑submission testing, should be prioritized to determine the exact attack vector and to develop targeted detection signatures. Continuous monitoring of the domain’s reputation across additional threat‑intel platforms is recommended, as the indicator’s risk level is currently elevated and the campaign remains active.