booking-com-dubai-thinnngs-to-do[.]webflow[.]io

Analysis of the domain booking-com-dubai-thinnngs-to-do.webflow.io indicates it is an active phishing infrastructure targeting users of the Booking.com platform. The domain was registered on June 12, 2026, through Webflow, a legitimate web development platform often exploited for hosting phishing pages due to its ease of use and free tier availability. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, which is associated with Cloudflare's content delivery network, a common tactic to obscure hosting origins and evade IP-based blocking. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal data shows that 2 out of 91 security vendors flag the domain as malicious, though the specific detection labels and methodologies are not disclosed in available intelligence. The low detection rate may reflect limited visibility or recent deployment, rather than an absence of malicious intent. No additional context is available regarding the phishing kit, targeted brand elements, or exact content of the site, as the page title and visual details have not been analyzed. Defenders should treat this domain as elevated risk due to its recent registration, association with a known phishing vector (Booking.com), and confirmation on a commercial blocklist.

Network-level blocking of the domain and its resolving IP is recommended. Organizations using Webflow-hosted domains should monitor for newly created subdomains that mimic travel, booking, or hospitality services, particularly those containing brand names or common typos. Further investigation into the hosting infrastructure and any linked email or payment collection methods is advised to determine the full scope of the campaign.