bookinggcomdubaiiitickets[.]webflow[.]io

bookinggcomdubaiiitickets.webflow.io was registered on June 12, 2026 via the Webflow platform. The domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare's edge network, a common hosting choice for short‑lived malicious sites. Security monitoring services have already identified the domain as part of a generic phishing campaign targeting users seeking tickets for events in Dubai. PhishDestroy has added the domain to its blocklist, and one additional security blocklist also lists it.

VirusTotal scans show that two of ninety‑one antivirus engines flagged the domain, indicating that at least a minority of detection products consider it malicious. No further data such as Safe Browsing verdicts, Open Threat Exchange reports, SSL certificate details, or HTTP response codes are publicly available at this time, leaving the exact landing‑page content, credential‑harvesting mechanisms, and any back‑end infrastructure uncertain. Defenders should immediately block resolution of 104.18.36.248 and add bookinggcomdubaiiitickets.webflow.io to URL filtering rules. Network monitoring should watch for outbound connections to the Cloudflare edge IP range, and email gateways should flag any messages containing links to this domain.

Continuous re‑scanning with updated VirusTotal and other multi‑engine platforms is advised, as additional detections may emerge. Organizations that frequently communicate with customers about event tickets should educate users to verify URLs and avoid clicking links from unsolicited sources. Maintaining up‑to‑date threat intelligence feeds that include the PhishDestroy blocklist will help ensure rapid detection of future variations that reuse the same registration method or hosting provider.