booking-com-dubai-flight-ticke-abd[.]webflow[.]io

Analysis of the domain booking-com-dubai-flight-ticke-abd.webflow.io shows that it was registered on 12 June 2026 through the Webflow platform, which is commonly used for hosting user‑generated sites. The domain resolves to the IP address 172.64.151.8, an address owned by Cloudflare’s edge network, indicating that the attacker is leveraging a reputable CDN to hide the true origin of the payload. The domain is currently listed on one public security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one trusted anti‑phishing service has observed malicious activity associated with it. VirusTotal scans report that 2 of 91 AV engines flag the domain, suggesting that some heuristics have identified it as suspicious, although the majority of scanners have not yet generated a detection.

The available intelligence does not include a TLS certificate fingerprint, HTTP response codes, page title, or any observed payload. Consequently, the exact content served by the site remains unknown, and no direct evidence of credential‑stealing forms or malware delivery has been captured. The limited detection footprint—only two vendor flags and a single blocklist entry—means that the infrastructure may be newly deployed or that automated crawlers have not fully indexed the site. Nonetheless, the combination of recent registration, use of a reputable CDN, and inclusion on a phishing‑specific blocklist aligns with patterns observed in active generic phishing campaigns that target travelers by mimicking airline or booking services.

Defenders should treat the domain as malicious until further analysis proves otherwise. Recommended actions include adding the hostname to outbound web filtering rules, updating intrusion‑prevention signatures to block traffic to 172.64.151.8 when associated with the domain, and monitoring DNS logs for queries to the same domain or its sibling subdomains.