bimi[.]bookingcomsfdubaishopping[.]webflow[.]io

The domain bimi.bookingcomsfdubaishopping.webflow.io was registered through the Webflow platform on June 12, 2026. DNS resolution points to the address 172.64.151.8, which is owned by the Webflow hosting infrastructure. The domain is currently active and has been classified with an elevated risk rating. Automated scanning on VirusTotal shows that 1 of 91 security vendors flagged the domain, indicating the presence of at least one detection rule that matches known malicious patterns. In addition, the domain is listed on a single external blocklist, and the phishing‑specific feed PhishDestroy has already added it to its blocklist.

The available intelligence does not include a public page title, SSL certificate details, or HTTP response codes, so the content served by the site has not been captured in the current data set. Consequently, the exact phishing lure employed by the domain cannot be confirmed without further inspection of the live page. The limited detection footprint—only one vendor flag and a single blocklist entry—suggests that the malicious infrastructure may be newly deployed, which aligns with the recent registration date. Defenders should proactively block DNS resolution to 172.64.151.8 and add the full hostname to web filtering rules.

Network‑level egress controls that deny outbound connections to the Webflow hosting range can reduce exposure. Continuous monitoring of the domain’s reputation on VirusTotal and other sandbox services is advised, as additional detections may appear as more scanners analyze the site. Because the domain mimics the brand “booking.com” in its sub‑domain label, organizations that process genuine booking.com traffic should verify TLS certificate details and host header values to avoid false positives. Until the site’s payload is captured, the precise phishing technique remains uncertain, but the existing indicators warrant immediate mitigation.