dubaii-booking-com[.]webflow[.]io[.]webflow[.]io

The domain dubaii-booking-com.webflow.io.webflow.io was registered on 12 June 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. VirusTotal scans have recorded three detections out of ninety‑one security vendors, indicating that a minority of scanners have identified malicious characteristics. The domain is listed on the PhishDestroy blocklist, and it appears on one additional security blocklist, reinforcing the notion that it is being actively monitored by threat‑intelligence feeds.

Infrastructure analysis shows the host is part of the Cloudflare network, as suggested by the IP range, which is commonly used for legitimate content delivery as well as for abuse. No public SSL certificate details, HTTP response codes, or page‑title metadata have been published in the current intelligence set, so the surface‑level web characteristics remain unknown. Likewise, safe‑browsing services and Open Threat Exchange (OTX) references have not been disclosed, limiting the ability to assess broader reputation signals.

Given the recent creation date, the association with a Webflow‑provided sub‑domain, and the presence on a phishing‑specific blocklist, the domain exhibits an elevated risk profile for generic phishing campaigns. Defenders should block network traffic to the IP address 172.64.151.8, add the full domain to URL filtering policies, and monitor DNS queries for the domain. Continuous re‑evaluation is advised as additional telemetry—such as SSL details, HTTP status, or page content—becomes available.