booking-com-dubaai-tickeeets[.]webflow[.]io[.]webflow[.]io

Analysis of the domain booking-com-dubaai-tickeeets.webflow.io.webflow.io shows concrete indicators of malicious activity. The site was created on June 12, 2026 and is hosted on the Webflow platform, as confirmed by the registrar information. Within the first month of existence the domain has been added to a security blocklist and is actively blocked by the PhishDestroy mitigation service, demonstrating that threat‑intelligence feeds have already flagged it as abusive.

VirusTotal scans reveal that three out of ninety‑one participating security vendors have generated detections for the domain, providing independent corroboration of its malicious nature. No additional infrastructure details such as IP address, autonomous system number, or SSL certificate information are publicly disclosed, and the page title or content has not been captured in the available intelligence. Consequently, the exact phishing payload or target brand cannot be specified beyond the generic classification supplied.

Defenders should immediately add the full domain to local blocklists, enforce DNS‑level filtering, and monitor outbound traffic for connections to the associated Webflow hosting endpoints. Continuous re‑evaluation is advised, as further analysis may reveal hosting IPs, content snapshots, or additional vendor detections that could refine response actions. The combination of early blocklist inclusion, active mitigation by PhishDestroy, and multi‑vendor detections establishes a high confidence level that the domain is being used for phishing operations and warrants proactive containment.