bookingcom-dubbaaaii-hottels[.]webflow[.]io

The domain bookingcom-dubbaaaii-hottels.webflow.io was registered on June 12, 2026 through the Webflow hosting service. The fully qualified domain resolves to the IP address 172.64.151.8, which belongs to the Webflow infrastructure. The domain is currently flagged as active with an elevated risk rating. Independent analysis by PhishDestroy has placed the domain on its blocklist, and the domain appears on one additional security blocklist.

VirusTotal reports that 2 of 91 scanned security vendors have flagged the domain as malicious, indicating that at least a small subset of scanners have identified suspicious behavior. The limited detection count suggests that the malicious payload or phishing page may be newly deployed or using techniques that evade many scanners. Publicly available intelligence does not provide a page title, SSL certificate details, or HTTP response codes, so the visual content and specific phishing lure remain unconfirmed. The presence of "bookingcom" in the subdomain strongly suggests an attempt to impersonate the Booking.com brand, but the exact nature of the credential‑stealing or data‑exfiltration flow has not been disclosed.

Consequently, defenders should assume the domain is being used to harvest credentials or payment information related to Booking.com users. Mitigation recommendations include adding the domain to local deny lists, configuring web proxies to block outbound HTTP/S requests to the IP 172.64.151.8, and monitoring DNS queries for the domain. Organizations should also enforce multi‑factor authentication for Booking.com accounts and educate users to verify URLs before entering credentials. Continuous re‑scanning of the domain on VirusTotal and other sandbox services is advised, as additional detections may emerge as the campaign evolves.