lyofmbooking-com-dubai-ticket[.]webflow[.]io

Analysis conducted on July 29, 2026 identifies lyofmbooking-com-dubai-ticket.webflow.io as an active phishing domain targeting airline ticket purchasers. The domain, registered on June 12, 2026 through Webflow, currently resolves to IP address 104.18.36.248, a shared hosting endpoint with no exclusive association to malicious activity. Detection data remains limited but indicative: two of ninety-one security vendors on VirusTotal classify the domain as malicious, while PhishDestroy has implemented a block, placing the domain on at least one operational security blocklist.

The subdomain structure, incorporating 'booking' and 'dubai-ticket', suggests an intent to impersonate travel or airline services, though the exact brand being mimicked has not been confirmed through available metadata. No SSL anomalies or HTTP status irregularities are reported; the domain returns a standard 200 response, indicating an operational web presence. Defenders are advised to treat this domain as elevated risk based on current detection counts and blocklist inclusion.

Further investigation should prioritise traffic analysis to determine victim demographics and submission patterns. Organisations operating in the travel sector or serving users in regions associated with Dubai travel should consider proactive monitoring and user education. Given the domain's recent creation and limited detection footprint, continued scanning is recommended to assess whether additional vendors update their classifications in response to emerging threat intelligence.