booking-com-dubai-things-to-doo[.]webflow[.]io

Analysis indicates that the domain booking-com-dubai-things-to-doo.webflow.io is an active phishing site targeting users of the Booking.com platform. The domain was registered on June 12, 2026, through Webflow, a legitimate platform often exploited for hosting phishing content due to its ease of deployment and free tier offerings. Infrastructure analysis reveals the domain resolves to the IPv6 address 2606:4700:440c::ac40:9708, which is associated with Cloudflare's network, a common obfuscation tactic used to mask the true origin of malicious infrastructure. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal telemetry shows that 16 out of 91 security vendors flag this domain as malicious, a detection rate consistent with confirmed phishing activity. The specific content of the site has not been fully analyzed, but the domain name and path structure strongly suggest an intent to deceive users seeking Booking.com services, particularly those searching for activities in Dubai. Defenders are advised to treat this domain as high-risk and implement blocking measures at the DNS, network, and endpoint levels.

Given the use of Webflow's infrastructure, monitoring for newly created subdomains under webflow.io with similar naming patterns may help preempt additional phishing campaigns. No evidence currently links this domain to a specific phishing kit or actor, and further investigation into the hosted content is required to determine the exact payload or credential harvesting mechanism employed. Organizations should correlate this domain with other indicators of compromise, particularly those involving Booking.com-themed phishing lures.