booking-com-dubai-tickets[.]webflow[.]io

The domain booking-com-dubai-tickets.webflow.io was registered on June 12 2026 through the Webflow platform, a service commonly used for rapid site deployment. DNS resolution points to the IPv4 address 172.64.151.8, which is consistent with the hosting infrastructure employed by Webflow and its upstream CDN providers. The domain has been added to a security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one anti‑phishing consortium has observed malicious activity associated with the host. VirusTotal analysis shows that 2 out of 91 scanning engines returned a positive classification, reinforcing the suspicion of abuse.

The limited detection footprint suggests a relatively new campaign, matching the recent registration date. No public SSL certificate details, HTTP response codes, or page title information have been published in the available intelligence, so the exact content served by the site remains unverified. Likewise, no additional blocklist entries, reputation scores, or threat‑intel feeds beyond the single blocklist mention are presently known. The presence of a Webflow‑hosted domain combined with a short‑lived registration and early vendor detections is a pattern frequently observed in generic phishing operations that aim to harvest credentials or redirect victims to malicious payloads.

Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any traffic to the associated IP address, and consider adding the host to internal blocklists. Threat‑intel teams are advised to request a full page capture to confirm the lure used, to enrich the profile with SSL and HTTP metadata, and to share any new indicators with community feeds. Ongoing observation is recommended until the domain is fully takedown‑ed or its activity ceases.