dashboard[.]booking-comabdubai-shopping[.]webflow[.]io

Analysis of the domain dashboard.booking-comabdubai-shopping.webflow.io indicates an active phishing campaign impersonating Booking.com, as suggested by the domain structure and confirmed by its classification in threat intelligence sources. The domain was registered on June 12, 2026, through Webflow, a platform commonly used for both legitimate and malicious web projects. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare's content delivery network, a frequent choice for phishing sites due to its provision of SSL encryption and IP masking capabilities. As of July 29, 2026, the domain appears on one security blocklist, and PhishDestroy has flagged it for blocking, indicating preliminary detection by at least one commercial anti-phishing vendor.

VirusTotal data shows that 3 out of 91 security vendors have detected this domain as malicious, a modest detection rate that may reflect either the campaign's recent activation or the use of evasion techniques. The specific content hosted on the domain has not been fully analyzed, though the subdomain structure ('booking-comabdubai-shopping') strongly suggests an intent to deceive users into believing they are interacting with Booking.com, a well-known travel and accommodation booking platform. No further details regarding the phishing kit, payload delivery mechanism, or targeted user actions (e.g., credential harvesting, payment redirection) are currently available. Defenders are advised to treat this domain as an elevated-risk threat.

Network-level blocking of 104.18.36.248 and the domain itself is recommended for organizations seeking to mitigate exposure. Security teams should monitor for connections to this domain in proxy logs, particularly those originating from users in regions or sectors likely to interact with travel booking services.