bookingcom-dubaes[.]webflow[.]io

Analysis conducted on July 29, 2026 identifies bookingcom-dubaes.webflow.io as an active phishing domain targeting users of the Booking.com travel platform. The domain is hosted on Webflow's infrastructure and resolves to the IP address 172.64.151.8. Four out of ninety-one security vendors on VirusTotal have flagged this domain, indicating a pattern of malicious activity. The domain is currently blocked by PhishDestroy and appears on at least one security blocklist, further confirming its elevated risk status.

Infrastructure analysis reveals the domain is registered through Webflow, a legitimate platform often exploited for phishing due to its ease of use and free hosting capabilities. The use of a subdomain format (webflow.io) suggests an attempt to leverage Webflow's reputation to evade initial scrutiny. No specific phishing kit or brand impersonation details beyond the domain name itself are currently available, though the inclusion of 'bookingcom' strongly implies an intent to deceive users into believing they are interacting with the legitimate Booking.com service. Defenders should treat this domain as high-risk and implement blocking measures at the DNS, proxy, or endpoint level.

Network security teams are advised to monitor for connections to 172.64.151.8 and review logs for any interaction with bookingcom-dubaes.webflow.io. Given the domain's presence on multiple detection and blocklist platforms, automated remediation through existing security controls is recommended. Further investigation into the exact content and payload of the site is necessary to determine the full scope of the threat, including any credential harvesting or malware distribution mechanisms.