booking-com-dubai-thiiiiiiiing--to-do[.]webflow[.]io

Analysis of the domain booking-com-dubai-thiiiiiiiing--to-do.webflow.io indicates an active phishing campaign targeting users of the Booking.com platform. The domain was registered on June 12, 2026, through Webflow, a platform commonly used for both legitimate and malicious web projects. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare’s content delivery network, a frequent choice for threat actors seeking to obfuscate hosting origins and evade takedowns. At the time of this report, the domain appears on one security blocklist, and PhishDestroy has flagged it as malicious, providing an additional layer of corroboration.

VirusTotal detection metrics show that 2 out of 91 security vendors have identified the domain as malicious, a modest but non-zero detection rate that aligns with early-stage phishing campaigns before broader vendor coverage is achieved. The domain’s structure, incorporating 'booking-com' and geographic references, strongly suggests an intent to deceive users into believing they are interacting with the legitimate Booking.com service. No evidence of SSL misconfiguration or HTTP errors was provided, though the use of Cloudflare typically ensures valid TLS certificates, further complicating detection for end users. Defenders should treat this domain as an elevated-risk threat due to its active status, targeted impersonation of a high-value brand, and partial vendor detection.

Network-level blocking of the domain and its resolving IP (104.18.36.248) is recommended for organizations seeking to mitigate exposure. Further analysis of the site’s content and backend infrastructure could yield additional indicators of compromise, though no login forms, payment pages, or specific scam mechanics have been confirmed in this report. Given the domain’s recent registration and limited detection footprint, continued monitoring for increased vendor flagging or blocklist expansion is advised.