booking-com-dubbbaai-hotels[.]webflow[.]io

On 29 July 2026 the domain booking-com-dubbbaai-hotels.webflow.io was observed in an active generic phishing campaign with an elevated risk rating. The domain was registered on 12 June 2026 through the Webflow platform, a service that provides hosted web‑site creation and content delivery. DNS resolution points to the IP address 172.64.151.8, which belongs to the infrastructure used by Webflow for customer sites. VirusTotal has recorded detections from two of ninety‑one scanning engines, indicating that at least a small subset of security products have identified malicious behavior associated with the domain.

The domain is listed on a single external blocklist and is currently blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing provider has taken mitigation action. No additional public intelligence such as Safe Browsing alerts, OTX references, SSL certificate details, HTTP status codes, or page‑title information is available at this time, limiting the ability to assess the full scope of the phishing payload or the specific victim‑targeting techniques employed. Because the site content has not been publicly harvested, the exact phishing vector—such as credential‑stealing forms or redirect behavior—remains unknown.

The limited detection footprint suggests that the campaign may be in an early deployment stage or that the hosting provider’s shared environment reduces the visibility of the malicious content. Defenders should monitor DNS queries for the domain and the associated IP address, enforce blocklist rules that include the observed entry, and consider adding the domain to internal URL filtering policies. Continuous re‑evaluation of VirusTotal and other threat‑intel feeds is recommended to capture any increase in detection counts or the emergence of additional indicators of compromise.