bbookingcomdubai[.]webflow[.]io

Analysis of the domain bbookingcomdubai.webflow.io indicates it is an active phishing site impersonating Booking.com, as classified by threat intelligence sources. The domain is hosted on Webflow's infrastructure and resolves to the IP address 172.64.151.8. At the time of this report, two out of 91 security vendors on VirusTotal have flagged the domain as malicious, and it appears on one security blocklist.

The domain's registration details point to Webflow as the registrar, though specific registration dates or ownership details are not provided in the available intelligence. The low detection rate on VirusTotal (2/91) suggests the domain may be relatively new or evading automated detection mechanisms, but the presence on a security blocklist confirms its malicious classification. No additional details regarding the site's content, such as page titles or specific phishing kit components, are available in the provided data.

Defenders should treat this domain as an elevated-risk threat due to its active status and confirmed phishing intent. Network-level blocking of the domain and its associated IP (172.64.151.8) is recommended to prevent potential credential harvesting or financial fraud targeting Booking.com users. Further investigation into the domain's hosting environment and any linked infrastructure may provide additional context for mitigation efforts.