dubai-ticket-booking[.]webflow[.]io

Analysis of dubai-ticket-booking.webflow.io shows a newly registered domain created on 12 June 2026 that is actively being used for malicious purposes. The domain is hosted on the Webflow platform and resolves to the IP address 172.64.151.8, indicating it is served from a shared hosting environment typical of Webflow‑based sites. At the time of assessment, VirusTotal records indicate that five of ninety‑one scanned security vendors flagged the domain as malicious, providing early vendor consensus of suspicious activity.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the classification of a phishing operation. The risk level is marked as elevated and the status remains active, suggesting ongoing exploitation. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content analysis is presently available, leaving the exact phishing vector and targeted brand undefined.

Defenders should immediately add dubai-ticket-booking.webflow.io to URL filtering and DNS deny‑list policies, monitor outbound traffic for connections to the associated IP, and share this indicator with threat‑intel platforms to broaden community awareness. Continuous re‑evaluation is advised as further content or network observations become available.