booking-com-dubbbbai-tickets[.]webflow[.]io

booking-com-dubbbbai-tickets.webflow.io was first observed on June 12, 2026, the same date the domain was registered through the Webflow platform. The domain resolves to the IP address 104.18.36.248, which belongs to Cloudflare’s edge network, a common hosting choice for both legitimate services and abuse operators. VirusTotal has indexed the domain and two of ninety‑one antivirus or URL‑filtering engines currently flag it as malicious. The domain also appears on a single external blocklist and is specifically listed by the PhishDestroy service, indicating that at least one anti‑phishing organization has classified it as a phishing resource.

No additional public threat‑intel feeds such as OTX or Google Safe Browsing are cited in the available data. The limited evidence points to a generic phishing campaign, but the exact lure, target brand, or credential‑harvesting method has not been disclosed. The lack of a page‑title or content analysis in the current dataset leaves the visual or functional aspects of the site unknown, leaving the full scope of the operation—whether it is part of a larger infrastructure or a one‑off test—uncertain. Defenders should add the domain to local deny lists, enforce DNS‑level blocking, and monitor for any outbound connections to the associated IP range.

Continuous re‑scanning on VirusTotal and periodic checks against updated blocklists are advised to capture any changes in detection status. Organizations that rely on brand‑specific email filters should consider treating any communications referencing “booking.com” or travel‑ticket offers that originate from this domain as suspicious. Incident response teams should also capture any network traffic that attempts to resolve or contact the domain for later forensic analysis.