booking-com-dubai-i-flight-tickets[.]webflow[.]io

Analysis of the domain booking-com-dubai-i-flight-tickets.webflow.io indicates active phishing infrastructure targeting Booking.com users. The domain was registered on June 12, 2026, through Webflow, a platform commonly used for rapid deployment of phishing sites due to its ease of use and free hosting tiers. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, a Cloudflare-assigned endpoint that obscures the true origin of the malicious content. As of July 29, 2026, the domain appears on one security blocklist, and two of 91 security vendors on VirusTotal have flagged it as malicious, suggesting early but growing detection coverage.

The domain is also blocked by PhishDestroy, a specialized anti-phishing service, further supporting its classification as a phishing threat. No additional context is available regarding the specific phishing kit, HTTP response codes, or page content, as the site has not undergone full forensic analysis. However, the domain name itself contains clear indicators of intent, incorporating the Booking.com brand and terms related to flight ticketing, a common lure for credential harvesting.

Defenders should treat this domain as elevated risk and prioritize blocking at the DNS and network perimeter levels. Given the low but non-zero detection rate, organizations may also consider retroactive log searches for connections to 104.18.36.248 or the domain itself to identify potential compromised accounts or unauthorized access attempts. Further monitoring of Webflow-hosted domains with similar naming patterns is recommended, as this platform remains a frequent vector for phishing campaigns.