booking-com-dubai-hhootels[.]webflow[.]io

The domain booking-com-dubai-hhootels.webflow.io resolves to the IP address 172.64.151.8, which is hosted on the Webflow platform. The registration record indicates the domain was created on 12 June 2026 via the Webflow registrar. VirusTotal scans show that 2 out of 91 security vendors have flagged the domain as malicious, indicating partial detection. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a phishing infrastructure.

The threat is categorized as generic phishing, and the risk level is elevated with the current status marked as active. No additional intelligence such as SSL certificate details, HTTP response codes, or page title is available at this time. The limited detection footprint suggests that the malicious infrastructure may be newly deployed, and further observation is required to ascertain the full scope of the campaign.

Defenders should add the domain and its associated IP address to block lists, monitor outbound DNS queries for lookups to the domain, and consider employing URL filtering that references the PhishDestroy blocklist. Continuous re‑scanning on VirusTotal and similar services is recommended to capture any changes in detection scores. Organizations should also educate users about unsolicited communications that reference "Booking.com" and "Dubai hotels" to reduce the likelihood of credential harvesting.