booking-com-dubai-flight-tickets-bookin[.]webflow[.]io

On 29 July 2026 the domain booking-com-dubai-flight-tickets-bookin.webflow.io was observed in active threat intelligence feeds. The domain was created on 12 June 2026 and is hosted on the Webflow platform, as indicated by the registrar information. DNS resolution returns the address 104.18.36.248, which is owned by Cloudflare’s edge network. VirusTotal has recorded two positive detections out of ninety‑one submitted scanners, confirming that at least two security vendors have flagged the domain as malicious.

The domain is listed on a single public blocklist and is currently blocked by the PhishDestroy service, reinforcing the assessment of an elevated risk level. The intelligence categorises the activity as generic phishing, although no additional details about the landing page or credential‑capture mechanisms have been disclosed. The limited visibility leaves uncertainty regarding the exact content served, the presence of TLS certificates, or any associated malware payloads.

Defenders should add the domain to internal block lists, monitor DNS queries for the IP 104.18.36.248, and enforce outbound filtering to prevent connections to the host. Continuous re‑scanning with VirusTotal and similar platforms is advised to capture any changes in detection scores. Organizations employing web‑filtering solutions should ensure the domain is blocked across all endpoints, and incident response teams should be prepared to investigate any user reports of unsolicited communications that reference the domain.