bookingcommdubaithiingstodoo[.]webflow[.]io

Analysis of bookingcommdubaithiingstodoo.webflow.io indicates an active phishing domain targeting users of Booking.com. The domain was registered on June 12, 2026, through Webflow, a platform commonly used for both legitimate and malicious sites. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, which may be part of a content delivery network or hosting provider used to obscure the true origin of the phishing infrastructure. As of July 29, 2026, the domain appears on at least one security blocklist, and two of 91 security vendors on VirusTotal have flagged it as malicious, suggesting early detection but limited widespread recognition.

The domain is currently blocked by PhishDestroy, a specialized phishing detection service, further supporting its classification as a phishing threat. No additional details regarding the specific phishing kit, exact content, or targeted user interaction (e.g., credential harvesting, payment redirection) are available at this time. The use of 'bookingcomm' and 'dubaithiingstodoo' in the subdomain suggests an attempt to impersonate Booking.com, likely leveraging travel-related themes to deceive users searching for Dubai activities or accommodations. Defenders should treat this domain as an elevated-risk phishing resource.

Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to the associated IP address (172.64.151.8), and alerting users to potential phishing attempts referencing Booking.com or Dubai travel services. Further investigation into the hosting infrastructure and any linked domains may reveal additional related threats. The domain remains active as of the report date, and no takedown or mitigation efforts are confirmed.