booking-com-dubai-flight-ticketstour[.]webflow[.]io

Analysis of booking-com-dubai-flight-ticketstour.webflow.io confirms its classification as an active phishing domain targeting users of Booking.com. The domain was registered on June 12, 2026, through Webflow, a platform commonly exploited for hosting phishing pages due to its ease of deployment and free tier availability. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, which is part of a network range frequently associated with malicious activity. As of July 29, 2026, the domain is flagged by 17 of 91 security vendors on VirusTotal, indicating a consensus among detection engines regarding its fraudulent nature.

It is also listed on at least one security blocklist, specifically PhishDestroy, further corroborating its malicious status. The domain's structure and naming convention—incorporating terms like 'booking-com' and 'dubai-flight-tickets'—strongly suggest an intent to deceive users into believing they are interacting with a legitimate Booking.com service. However, the exact content and functionality of the site remain unanalyzed; no page title, brand confirmation, or phishing kit details are currently available.

Defenders should treat this domain as a confirmed phishing threat targeting the travel and hospitality sector. Recommended actions include blocking the domain and its resolving IP at the network level, updating endpoint protection signatures, and alerting users to the presence of this threat. Given the domain's recent registration and active blocklist status, continuous monitoring for related infrastructure or newly registered lookalike domains is advised.