booking-com-dubai-flight-ticke-bcab[.]webflow[.]io

Analysis of the domain booking-com-dubai-flight-ticke-bcab.webflow.io indicates an active phishing campaign targeting users of the Booking.com travel platform. The domain was registered on June 12, 2026, through Webflow, a legitimate website builder often exploited for hosting malicious content due to its ease of deployment and free tier offerings. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare's content delivery network, a common obfuscation tactic used to conceal the true origin of phishing infrastructure. Detection data from VirusTotal shows that 2 out of 91 security vendors have flagged this domain as malicious, suggesting early but growing recognition of its threat status. The domain appears on at least one security blocklist, specifically PhishDestroy, which has classified it as a phishing threat.

The low detection count at this stage may reflect the campaign's recent deployment or the use of evasion techniques, such as cloaking or dynamic content delivery, to avoid automated detection systems. The domain name itself employs a combination of brand impersonation and urgency-driven keywords, including 'booking-com' and 'dubai-flight-ticke,' likely intended to deceive users searching for travel-related services. While the exact content of the site has not been analyzed, the structure of the domain suggests an attempt to mimic Booking.com's branding to harvest credentials, payment details, or personal information from victims. No evidence currently links this domain to a known phishing kit or specific threat actor group.

Defenders are advised to treat this domain as an elevated risk due to its active status, brand impersonation, and presence on security blocklists. Network-level blocking of the domain and its resolving IP (104.18.36.248) is recommended to prevent user exposure.