booking-com-dubaitickets[.]webflow[.]io

Analysis as of July 29, 2026 shows that the domain booking-com-dubaitickets.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. DNS resolution points to the IP address 104.18.36.248, which is part of the Cloudflare network commonly used for fast content delivery and also for malicious hosting. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal scans returned detections from 2 of 91 AV engines, indicating that at least two independent scanners have identified malicious behavior associated with the domain.

No additional public intelligence such as Safe Browsing alerts, OTX mentions, or SSL certificate anomalies have been published at this time. The limited detection surface suggests the site is newly deployed and may be used for credential harvesting campaigns targeting travelers searching for Dubai tickets. Defenders should add the domain to deny lists, monitor outbound DNS queries for the IP 104.18.36.248, and enforce URL filtering policies that block traffic to the domain.

Endpoint protection solutions should be updated to include the two detecting AV signatures. Because the hosting provider is a legitimate SaaS platform, takedown requests may be slower; security teams should consider reporting the abuse to Webflow’s abuse contact. Ongoing observation is recommended to capture any changes in page content, additional blocklist listings, or increased detection counts.