booking-com-dubai-flightes-tickets[.]webflow[.]io

On July 29 2026, security analysts examined the domain booking-com-dubai-flightes-tickets.webflow.io. The domain was registered through the Webflow platform and first observed on June 12 2026. DNS resolution points to the address 104.18.36.248, indicating that the site is hosted on infrastructure associated with that IP. VirusTotal scans show that 3 of 91 security vendors flagged the domain as malicious, providing a modest but notable detection rate.

The domain is listed on a single public blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one commercial threat‑intelligence feed considers it a phishing vector. No public page title, SSL certificate details, HTTP status code, or Safe Browsing verdict were available at the time of analysis, so the visual content and transport‑layer security posture remain unknown. Likewise, there are no observable references in OTX or additional blocklists beyond the one entry noted. The limited detection footprint suggests that the infrastructure may be newly deployed or used in a targeted fashion, but the presence on a phishing‑specific blocklist and the detection by multiple vendors indicate an active threat.

Defenders should add the domain to DNS‑level deny lists, monitor outbound connections to the associated IP, and enforce URL filtering that blocks known phishing domains. Continuous re‑scanning with VirusTotal and periodic checks of blocklist repositories are advised to capture any changes in detection status. Until further forensic evidence is gathered, the domain should be treated as an elevated‑risk phishing site that impersonates the Booking brand.