booking-com-dubaai-paackages[.]webflow[.]io[.]webflow[.]io

This domain, booking-com-dubaai-paackages.webflow.io, is identified as a credential theft operation impersonating Booking.com. Analysis indicates the site presents fraudulent Dubai travel package offers to harvest user login credentials, payment details, and personal information. The campaign leverages Booking.com's brand recognition to deceive victims into entering sensitive data on spoofed reservation pages, a common tactic in travel industry phishing schemes. Infrastructure analysis reveals the domain was registered through Webflow on June 12, 2026, and resolves to IP address 172.64.151.8. Detection metrics show 3 out of 95 security vendors flagged the domain on VirusTotal, while it appears on one security blocklist. The domain's creation date suggests recent deployment, aligning with typical phishing campaign lifecycles. No Google Safe Browsing detections were recorded at the time of analysis, though this may reflect detection latency rather than absence of malicious activity. The domain has been taken offline, likely following abuse reports or registrar intervention. While no longer active, the infrastructure remains a potential risk if reactivated. Users who interacted with the site should immediately reset Booking.com credentials and monitor financial statements for unauthorized transactions. Organizations are advised to block the domain and associated IP in perimeter defenses, and to educate users on recognizing brand impersonation tactics in travel-related communications.