bookingcom-dubairestaurants[.]webflow[.]io

bookingcom-dubairestaurants.webflow.io is a newly registered Webflow‑hosted domain created on 12 June 2026 that mimics the Booking.com brand. The domain resolves to the IP address 172.64.151.8 and is currently listed on a single public blocklist. PhishDestroy has already added the domain to its deny list, and VirusTotal reports that 3 of 91 security scanners flag the domain as malicious. The registration was performed through the Webflow service, which provides shared hosting and automatic TLS certificates, so the site likely presents a valid HTTPS certificate issued to the Webflow infrastructure.

No additional intelligence such as page title, Safe Browsing verdict, OTX tags, or SSL certificate details have been published, leaving the exact content of the landing page unknown. Analysts can infer that the domain is being used for a generic phishing campaign targeting users of the Booking.com service, given the inclusion of the brand name in the sub‑domain. The single blocklist entry indicates early detection, but the low count also suggests limited propagation at this stage. Defenders should update web filtering rules to block both the exact host name and its parent zone (webflow.io) for the duration of the investigation, enforce DNS sink‑holing for the IP 172.64.151.8, and monitor outbound traffic for connections to that address.

Email gateways should be tuned to flag messages containing the URL or any short‑links that resolve to it. Incident response teams should collect any observed network logs that reference the domain, capture HTTP requests for forensic analysis, and consider sharing indicators of compromise with peers via TAXII or similar threat‑sharing platforms. Because the domain is only a few weeks old, additional copies may appear on other hosting services; continuous monitoring of newly registered Webflow domains that contain "bookingcom" or similar brand keywords is recommended.