bookingcommdubaiihotels[.]webflow[.]io

Analysis of the domain bookingcommdubaiihotels.webflow.io indicates it is an active phishing site impersonating Booking.com's hotel reservation platform. The domain was registered on June 12, 2026, through Webflow, a legitimate website builder often exploited for phishing due to its free hosting and SSL certificates. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, which is associated with Cloudflare's content delivery network, a common obfuscation tactic used to conceal the true hosting provider and evade IP-based blocking. Detection data shows the domain is currently flagged by 2 of 91 security vendors on VirusTotal, a low but non-zero detection rate that suggests emerging recognition.

It also appears on one security blocklist, specifically PhishDestroy, which has classified it as malicious. No additional blocklist presence or Safe Browsing warnings were provided in the available intelligence. The domain's registration details do not include identifiable threat actor information, and no known phishing kit signatures or brand-specific artifacts have been confirmed at this stage. Defenders should treat this domain as an elevated-risk threat due to its recent registration, impersonation of a high-value travel booking brand, and use of Cloudflare to mask infrastructure.

The domain's Webflow origin does not inherently indicate malicious intent, but the combination of free hosting, SSL provisioning, and brand impersonation aligns with common phishing tactics. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for related subdomains or IP associations, and alerting users to potential Booking.com-themed phishing attempts. Further analysis of the site's content and backend infrastructure is required to determine the exact payload or data collection methods employed.