booking-com-dubaii-fliightt-tickets[.]webflow[.]io

The domain booking-com-dubaii-fliightt-tickets.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain as malicious, indicating that at least a minority of scanners have identified suspicious characteristics. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing the presence of threat intelligence that associates the host with phishing activity. The risk rating is elevated and the status is active, suggesting that the infrastructure is currently being used for malicious campaigns.

The use of a Webflow subdomain is consistent with observed phishing infrastructure that leverages legitimate hosting services to evade basic reputation checks. However, detailed content analysis, such as page title, SSL certificate details, or HTTP response codes, has not been published, leaving the exact nature of the payload or credential‑capture mechanisms uncertain. Defenders should prioritize immediate blocking of the full domain and its parent Webflow namespace at perimeter defenses, DNS filtering, and proxy layers.

Continuous monitoring of the IP address 172.64.151.8 for additional malicious activity is advised, as Webflow hosts many unrelated legitimate sites that share the same address range. Organizations that rely on the Booking.com brand should enforce strict URL validation, educate users about the risk of look‑alike subdomains, and consider deploying email and web gateway rules that reference the known malicious domain. Ongoing intelligence collection, including periodic re‑scanning on VirusTotal and checking for new blocklist entries, will help maintain situational awareness as the threat actor potentially evolves its infrastructure.