mail[.]booking-dubaii-hotels[.]webflow[.]io

The domain mail.booking-dubaii-hotels.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. Independent analysis shows the domain is listed on a security blocklist and has been actively blocked by the PhishDestroy sinkhole. VirusTotal scans report that three of ninety‑one security vendors have flagged the domain as malicious, indicating a low but non‑zero detection rate among automated scanners. No additional public intelligence such as Safe Browsing verdicts, OTX tags, or SSL certificate details are currently available for this host.

The lack of a disclosed page title, brand targeting information, or observed payloads means that the exact phishing lure (e.g., credential harvesting, payment fraud) cannot be definitively identified at this time. However, the domain name itself incorporates the keywords “booking”, “dubaii”, and “hotels”, which are typical of travel‑related credential‑stealing campaigns. Infrastructure analysis reveals the hosting provider is Webflow, a legitimate SaaS that offers free sub‑domains, a factor often abused by threat actors to obtain a trusted TLS certificate without additional cost.

Defenders should add the resolved IP 172.64.151.8 and the full domain to network‑level blocklists, monitor DNS queries for the domain, and enforce URL filtering rules that deny access to any HTTP(S) resources under the *.webflow.io namespace when the sub‑domain contains high‑risk keywords. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any future changes in detection status. Organizations should also educate users about unsolicited travel‑booking communications that request login credentials or payment information, as these are common vectors for the type of campaign suggested by the domain’s naming pattern.