booking-com-dubei-hotels[.]webflow[.]io

Analysis of booking-com-dubei-hotels.webflow.io confirms its classification as an active phishing domain targeting users of Booking.com. The domain was registered on June 12, 2026, through Webflow, a platform often abused for hosting fraudulent sites due to its ease of deployment and free tier availability. As of July 29, 2026, the domain resolves to IP address 172.64.151.8 and appears on at least one security blocklist, specifically PhishDestroy. VirusTotal scans indicate that 4 out of 91 security vendors flag this domain as malicious, providing further technical evidence of its phishing nature.

Infrastructure analysis reveals the domain is hosted on Webflow's infrastructure, which is consistent with observed patterns of phishing campaigns leveraging legitimate hosting services to evade initial detection. The domain name itself contains the string 'booking-com,' strongly suggesting an intent to deceive users into believing the site is affiliated with the legitimate Booking.com platform. No additional brand-specific indicators, such as page titles or phishing kit signatures, were provided in the available intelligence, so the exact content and mechanics of the phishing attempt remain unconfirmed. Defenders are advised to treat this domain as a high-confidence phishing threat.

Network-level blocking of 172.64.151.8 and the domain itself is recommended. Security teams should monitor for user reports of credential harvesting or payment fraud originating from this domain and conduct retrospective analysis of logs for connections to the IP or domain. Given the domain's recent registration and active status, further monitoring of Webflow-hosted subdomains with similar naming patterns is warranted to identify potential related threats.