booking-com-dubaai-fligght-tickets[.]webflow[.]io

This domain, booking-com-dubaai-fligght-tickets.webflow.io, was registered on June 12, 2026 through the Webflow platform and is currently resolving to the IP address 104.18.36.248. The hosting provider is identified as Webflow, which commonly uses Cloudflare edge servers, and the IP belongs to a Cloudflare network that hosts many legitimate sites as well as malicious infrastructure. VirusTotal scans show that two out of ninety‑one security vendors have flagged the domain as malicious, indicating that at least a minority of detection engines have identified it as part of a phishing campaign.

The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy mitigation service. No additional public evidence such as page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts is available at this time. The limited detection footprint, combined with the recent creation date and the use of a reputable hosting platform, suggests a quickly deployed phishing infrastructure that relies on the perceived legitimacy of the Webflow service to evade basic reputation checks.

Defenders should treat the domain as high‑risk: add the fully qualified domain name to DNS and proxy deny lists, block the associated IP address, and monitor outbound traffic for attempts to contact the same host. Because the underlying IP is shared, broader network‑level controls such as Cloudflare IP reputation filters may be applied, but care should be taken to avoid collateral impact on legitimate Webflow customers. Continuous monitoring of threat‑intel feeds for new indicators related to this domain, as well as periodic re‑scans on VirusTotal, is recommended to capture any escalation in detection rates.