d2ggoe18h1as73d4nb2g[.]bookingcomddubaiflilghtttiicketss[.]webflow[.]io

Analysis of the domain d2ggoe18h1as73d4nb2g.bookingcomddubaiflilghtttiicketss.webflow.io shows a newly created web‑hosting asset that is actively used for a generic phishing campaign. The domain was registered on June 12, 2026 through the Webflow platform, a service that provides shared hosting and site‑building tools. VirusTotal records indicate that three of ninety‑one scanned security vendors flagged the domain as malicious, confirming that at least a subset of antivirus and URL‑filter engines have identified suspicious behavior. The domain also appears on a single public security blocklist, and it is listed as blocked by the PhishDestroy mitigation service, further evidencing its classification as a phishing vector.

No additional public intelligence such as Safe Browsing verdicts, Open Threat Exchange (OTX) citations, IP address reputation, SSL certificate details, HTTP response codes, or trust‑score metrics is currently available for this domain. Likewise, the page title and any evidence links have not been disclosed, limiting the ability to confirm the exact content served to victims. Consequently, the precise lure or credential‑harvesting mechanism remains uncertain, though the naming pattern suggests an attempt to impersonate a booking or flight‑ticket service targeting travelers to Dubai.

Defenders should update their URL filtering and DNS block policies to include the full domain and its parent zone (webflow.io) where feasible, especially in environments that service travel‑related traffic. Continuous monitoring of VirusTotal and other multi‑engine scanners is advised to capture any changes in detection rates. Organizations should also consider employing email‑authentication hardening (DMARC, SPF, DKIM) and user education campaigns that reference the observed domain pattern, as this can reduce the likelihood of successful credential harvesting.