booking-com-dubai-tiicckets[.]webflow[.]io

Analysis as of July 29 2026 indicates that the domain booking-com-dubai-tiicckets.webflow.io is actively used for malicious phishing operations. The site was registered on June 12 2026 through the Webflow registrar, a platform commonly leveraged for rapid deployment of fraudulent pages. DNS resolution points to the IP address 104.18.36.248, which is owned by a content‑delivery network used by many legitimate Webflow sites, providing the attacker with reputable hosting infrastructure that can help evade simple network‑based filters.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed has identified it as hostile. VirusTotal analysis shows that 2 of 91 scanned security vendors flagged the domain, reinforcing the suspicion despite a relatively low detection ratio. No additional public intelligence such as Safe Browsing, OTX, or SSL certificate details is currently available, and the page title has not been disclosed, limiting the ability to confirm the exact content served.

Given the evidence, defenders should treat the domain as high‑risk. Recommended actions include adding the domain to network‑level deny lists, configuring web‑filtering solutions to block any HTTP or HTTPS requests to the host, and monitoring for related indicators such as traffic to the same IP address or other subdomains created after June 2026 on the Webflow platform. Continuous re‑evaluation is advised, as further analysis of the page content or additional vendor detections could provide more precise attribution.