booking-com-dubaishopping[.]webflow[.]io

Analysis performed on July 29, 2026 indicates that the domain booking-com-dubaishopping.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. The domain resolves to the IP address 172.64.151.8, which is associated with Webflow’s infrastructure. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that it is being used in an ongoing malicious campaign. VirusTotal reports that 2 of 91 scanned security vendors flagged the domain, providing additional independent confirmation of malicious intent. The threat type is catalogued as generic phishing, and the risk level is elevated while the status remains active.

Evidence suggests that the site is being leveraged to harvest credentials or other sensitive information, although the specific payload or lure has not been publicly disclosed. No information is available regarding SSL certificate details, HTTP response codes, or page title, and no additional intelligence such as OTX or Safe Browsing entries have been reported. Consequently, the precise technique employed by the actor remains uncertain. Defenders should block network connections to the domain and its resolving IP, add the domain to local deny lists, and monitor for any authentication attempts that reference the domain.

Organizations should also consider enforcing multi‑factor authentication for accounts that could be targeted, and educate users to verify URLs before entering credentials. Logging of DNS queries for the domain can aid in early detection of compromise attempts. Continuous re‑evaluation is advised, as additional detections may emerge from other scanning services. The combination of recent registration, hosting on a popular website‑builder service, blocklist presence, and multiple vendor detections makes the domain a high‑confidence indicator of phishing activity.