booking-comdubaaiiflightticketts[.]webflow[.]io

The domain booking-comdubaaiiflightticketts.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. DNS resolution points to the IP address 172.64.151.8, which is part of Cloudflare's network and is commonly used for legitimate web services as well as malicious hosting. VirusTotal has recorded detections from 10 of 91 scanned security vendors, indicating that multiple scanners have flagged the site as malicious. The domain is presently listed on one external blocklist and has been actively blocked by the PhishDestroy mitigation service.

The threat is classified as a generic phishing operation with an elevated risk rating, and the infrastructure remains active as of the report date, July 29, 2026. Evidence confirms that the site is being leveraged to target users, although the specific content, page title, and credential‑capture mechanisms have not been publicly disclosed. No additional intelligence such as SSL certificate details, HTTP response codes, or Safe Browsing verdicts is available at this time. Consequently, the precise lure or victim profile cannot be determined beyond the generic phishing label.

Defenders should add the domain and its resolving IP address to outbound filtering rules, ensure that DNS‑based blocklists include the observed entry, and monitor for any related Webflow‑hosted subdomains that may appear with similar naming patterns. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection status. Organizations using web‑filtering solutions that integrate PhishDestroy signatures can rely on the existing block, but should also verify that internal proxy or firewall policies deny traffic to the identified IP. Ongoing threat‑intel feeds should be consulted for new indicators linked to this infrastructure.