booking-com-duubai-shopppiing[.]webflow[.]io

Analysis indicates that booking-com-duubai-shopppiing.webflow.io is an active phishing domain targeting users of the Booking.com platform. The domain was registered on June 12, 2026, through Webflow, a legitimate hosting provider often exploited for phishing due to its ease of deployment. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, which is associated with Cloudflare's network, a common obfuscation tactic used to conceal the true origin of malicious infrastructure. As of July 29, 2026, the domain appears on one security blocklist, and two out of 91 security vendors on VirusTotal have flagged it as malicious, suggesting early but growing detection. The domain name itself contains elements designed to deceive users, including 'booking-com' and 'duubai' (a misspelling of 'Dubai'), which may lure victims searching for travel or hotel-related services.

The use of 'shopppiing' (a misspelled variant of 'shopping') further indicates an attempt to appear as a legitimate commerce or booking site. No specific phishing kit or brand impersonation details are available in the current intelligence, but the structure aligns with known Booking.com phishing campaigns observed in prior years. Defenders should treat this domain as elevated risk. The domain is currently active and blocked by PhishDestroy, a specialized anti-phishing service.

Organizations are advised to proactively block the domain and its resolving IP (172.64.151.8) at the network perimeter. Security teams should monitor for any internal connections to this domain, particularly from endpoints associated with travel, finance, or customer service departments. Given the domain's recent registration and low but increasing detection rate, further analysis is recommended to determine the full scope of the campaign, including any associated email or SMS vectors used for distribution.