booking-com-dubaii-flights-tickets[.]webflow[.]io

Analysis indicates that the domain booking-com-dubaii-flights-tickets.webflow.io was registered on June 12, 2026 through the Webflow platform, a service that provides hosted website builder infrastructure. DNS resolution points to the IP address 104.18.36.248, which belongs to a content‑delivery network commonly used for legitimate traffic. Despite the benign hosting environment, the domain has been flagged by multiple security vendors. VirusTotal records show that 17 out of 91 scanning engines have raised detections, confirming malicious reputation.

The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy filtering service. These indicators collectively assign the domain an elevated risk rating. Publicly available intelligence does not include a page title, SSL certificate details, or HTTP response codes, leaving the exact content of the site unverified. The absence of such data prevents confirmation of the phishing vector, but the presence of multiple vendor detections and blocklist entries strongly suggests that the site is being used for credential‑stealing or related fraudulent activity.

Defenders should treat the domain as hostile: incorporate the fully qualified domain name into network‑level deny lists, update DNS sinkhole configurations, and ensure endpoint protection solutions ingest the VirusTotal detection count. Continuous monitoring of the associated IP address for new malicious domains is also advised, as the CDN may host additional phishing infrastructure in the future. Organizations that rely on Webflow‑hosted assets should verify that legitimate internal sites are not inadvertently sharing the same CDN edge nodes, and enforce strict content‑security policies to mitigate cross‑site contamination.