wzmxebooking-tour-dubai[.]webflow[.]io

Analysis dated July 29, 2026 identifies wzmxebooking-tour-dubai.webflow.io as an active infrastructure supporting a generic phishing campaign with an elevated risk rating. The domain was registered on June 12, 2026 through the Webflow platform, a service that provides hosted website building tools. DNS resolution points to the IP address 172.64.151.8, which is owned by the Cloudflare network and is commonly used for fastly‑delivered content. VirusTotal scans have recorded detections from 2 of 91 security vendors, indicating that at least a minority of scanners have flagged the host as malicious.

Independent blocklist monitoring shows that PhishDestroy has already added the domain to its blacklist, and the domain appears on one additional security blocklist, reinforcing the view that it is being treated as hostile by threat‑intelligence aggregators. Publicly available data does not yet disclose the site’s SSL certificate details, HTTP response codes, page title, or any associated threat‑intel feeds such as OTX or Google Safe Browsing. Consequently, the full scope of the phishing payload, targeted brand, and lure technique remain unknown.

Defenders should block traffic to 172.64.151.8 and add wzmxebooking-tour-dubai.webflow.io to local deny lists. Continuous monitoring of the domain’s DNS records, any changes in detection counts on VirusTotal, and the appearance of the domain in additional blocklists is recommended. Organizations that employ email filtering or web proxy solutions should ensure that signatures covering this domain are refreshed, and users should be warned that links containing this sub‑domain may lead to credential‑stealing pages.