bookinngcomduubaitickets[.]webflow[.]io

bookinngcomduubaitickets.webflow.io was registered on 12 June 2026 via the Webflow platform. The domain resolves to the IPv4 address 172.64.151.8 and is currently listed on a single security blocklist, PhishDestroy, which has taken the domain offline for its customers. VirusTotal analysis shows that two of the 91 scanned security vendors flagged the domain as malicious, indicating that at least a subset of detection engines recognize it as a threat. The risk rating assigned is elevated and the operational status is active, suggesting the site is still reachable and may be used in ongoing campaigns.

No public page title, SSL certificate details, or Safe Browsing verdict have been published for the domain, and no additional intelligence such as OTX tags, ASN, or country attribution is available. Consequently, the exact phishing payload, targeted brand, or lure technique remains unknown pending deeper content inspection. Defenders should proactively block the fully qualified domain name and its resolved IP address in DNS filtering, proxy, and endpoint protection solutions. Adding the domain to internal URL blocklists and sharing the indicator with upstream threat‑sharing feeds will help reduce exposure.

Continuous monitoring of traffic to 172.64.151.8 for anomalous HTTP requests, especially outbound credential submissions, is recommended. If the domain appears in future VirusTotal or other sandbox analyses, the associated detection signatures should be incorporated into intrusion‑detection rules. Given the recent registration date and the presence on PhishDestroy, the indicator should be treated as high‑confidence evidence of a phishing campaign.