bookings-com-dubai-flight-tick-cbcbec[.]webflow[.]io[.]webflow[.]io

The domain bookings-com-dubai-flight-tick-cbcbec.webflow.io.webflow.io was created on 12 June 2026 and is registered through the Webflow platform, a popular SaaS website builder that provides automatic DNS hosting. DNS resolution points to the address 104.18.36.248, an IP range operated by Cloudflare, a global content‑delivery network frequently leveraged by malicious actors to hide origin infrastructure. The domain currently appears on a single public security blocklist and is actively blocked by the PhishDestroy feed, reflecting early detection by a dedicated anti‑phishing service. VirusTotal has processed the host and 3 of 91 antivirus or URL‑reputation scanners have raised a detection, confirming that at least a subset of security tools classify the site as malicious.

No public information is available regarding the site’s SSL certificate, HTTP response status, page title, Safe Browsing rating, or Open Threat Exchange (OTX) tags, indicating that content analysis has not yet been published. The limited observable indicators are consistent with a generic phishing operation that likely advertises a bogus Dubai flight ticket, aiming to harvest credentials from travelers. Because the underlying hosting is Webflow, the site can be rapidly re‑deployed or moved, which adds operational agility for the threat actors. Uncertainty persists around the exact phishing kit, the presence of additional affiliate infrastructure, and whether live credential‑stealing forms are presently served.

Defensive recommendations include provisioning the full domain name in perimeter firewalls and DNS‑filtering solutions, ingesting the IP 104.18.36.248 into network‑level blocklists, and monitoring outbound connections to Webflow‑hosted subdomains for anomalous activity. Security operations should also request a content snapshot via a sandbox or manual inspection to verify the phishing payload, and enrich threat‑intel feeds with the observed detections to improve collective detection.