booking--comdubaithingtodo[.]webflow[.]io

This domain, booking--comdubaithingtodo.webflow.io, is flagged as an active phishing site impersonating Booking.com. Registered on June 12, 2026, through Webflow, it resolves to IP address 172.64.151.8. As of July 29, 2026, the domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal analysis indicates that 2 out of 91 security vendors detect this domain as malicious, suggesting early but limited recognition of the threat.

Infrastructure analysis reveals the domain is hosted on Webflow's platform, which is commonly used for both legitimate and malicious sites due to its ease of deployment. The IP address 172.64.151.8 does not provide additional context regarding hosting provider or geolocation beyond Webflow's infrastructure. No SSL certificate details, HTTP response codes, or page content analysis are currently available, limiting further assessment of the site's behavior or specific phishing tactics. Defenders should treat this domain as an elevated-risk threat due to its impersonation of a well-known travel booking service.

Immediate action includes blocking the domain and IP at the network perimeter, updating endpoint protection signatures, and monitoring for related indicators of compromise. Given the domain's recent registration and limited detection on security platforms, additional related domains or infrastructure may emerge. Security teams should correlate this domain with internal logs for any user interactions, particularly those involving credential submission or payment details. If internal telemetry confirms exposure, initiate incident response procedures for potential credential theft or financial fraud.