booking-com-dubai-tickettss[.]webflow[.]io

Analysis indicates that booking-com-dubai-tickettss.webflow.io is an active phishing domain registered on June 12, 2026, through Webflow. The domain currently resolves to IP address 172.64.151.8 and has been flagged by two of the security vendors on VirusTotal as of the latest scan. It appears on one security blocklist and is actively blocked by PhishDestroy. The infrastructure is hosted on Webflow's platform, which is commonly used for both legitimate and malicious sites, making registrar-based filtering less effective without additional context.

The domain's name suggests an attempt to impersonate a travel or ticketing service, though the exact content and targeted brand have not been confirmed through available evidence. No HTTP status, SSL certificate details, or page title data were provided, limiting further technical assessment. The low detection count on VirusTotal does not indicate safety, as many phishing domains evade initial scans before being widely recognized. Defenders should treat this domain as an elevated-risk threat due to its recent registration, active blocklist presence, and association with a known phishing campaign pattern.

Immediate action includes blocking the domain and IP at network and endpoint levels, monitoring for related subdomains or newly registered lookalike domains, and checking logs for connections to 172.64.151.8. If internal users have interacted with this domain, credentials or payment details may have been compromised, warranting password resets and transaction reviews. Further investigation into the domain's content and any linked infrastructure is recommended to determine the full scope of the campaign.