booking-com-dubaai-tickeeets[.]webflow[.]io

The domain booking-com-dubaai-tickeeets.webflow.io was registered on June 12, 2026 and is hosted on the IP address 172.64.151.8, which belongs to the Cloudflare network commonly used by Webflow customers for CDN and DNS services. The domain’s short lifespan—less than two months at the time of this assessment—combined with its rapid appearance on a security blocklist and detection by the PhishDestroy sinkhole indicates an active malicious campaign. VirusTotal analysis shows that two of ninety‑one security vendors have flagged the domain, providing independent confirmation of suspicious behavior.

The registration through Webflow further suggests that the attacker leveraged a legitimate hosting platform to obscure infrastructure and benefit from Cloudflare’s protective edge, a tactic frequently observed in phishing operations. No public page title, SSL certificate details, or Safe Browsing verdicts are available, leaving the content of the landing page unverified. Consequently, the precise phishing vector—such as credential harvesting for a travel service—remains uncertain.

Defenders should immediately block the domain and its associated IP address at network perimeter controls, add the host to URL filtering and reputation lists, and monitor for any related subdomains or traffic patterns that may indicate campaign expansion. Continuous re‑evaluation is advised as additional intelligence, such as content analysis or further vendor detections, becomes available.