bookingcomtickets-dubai[.]webflow[.]io

Analysis indicates that the domain bookingcomtickets-dubai.webflow.io is an active phishing resource flagged by multiple security mechanisms as of July 29, 2026. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, a Cloudflare-hosted endpoint commonly used for Webflow-hosted sites. The domain was registered through Webflow, a platform that allows users to create and host websites without direct domain registrar involvement, which may complicate traditional WHOIS-based attribution. Detection data shows the domain is currently blocked by PhishDestroy and appears on at least one security blocklist. VirusTotal reports that 4 out of 91 security vendors flag this domain as malicious, though the specific detection logic and threat classification from those vendors remain unconfirmed.

The exact content and target of the phishing campaign are not yet analysed, as no page title, brand target, or scam type classification was provided in the available intelligence. The domain name suggests an attempt to impersonate a booking or ticketing service related to Dubai, but no definitive brand association can be established from the domain spelling alone. No SSL certificate anomalies or HTTP status errors were reported in the supplied data, indicating the site may be fully operational and accessible to potential victims. Defenders should treat this domain as an elevated-risk phishing resource.

Network-level blocking of 104.18.36.248 and the full domain bookingcomtickets-dubai.webflow.io is recommended for enterprise and consumer security tools. Given the use of Webflow hosting, takedown requests should be directed to Webflow’s abuse team with evidence of phishing activity. Further analysis of the site’s content, including login forms, branding, and redirection behavior, is necessary to determine the precise phishing kit or campaign family. Until such analysis is completed, the domain should be considered hostile and actively targeting users.