bookinngcomduubaiticketss[.]webflow[.]io

Analysis conducted on July 29, 2026 identifies the domain bookinngcomduubaiticketss.webflow.io as an active generic phishing infrastructure. The domain was created on June 12, 2026 and is registered through the Webflow platform, which provides hosting for user‑generated sites. DNS resolution points to the IP address 104.18.36.248, a range operated by Cloudflare, indicating that the malicious payload is likely delivered via a CDN service.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, demonstrating that at least one reputable anti‑phishing source has taken action against it. VirusTotal scans show that two of ninety‑one security vendors have flagged the domain, confirming that detection capability exists but remains limited across the broader ecosystem. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content analysis is currently available, leaving the exact lure and credential‑capture mechanisms unverified.

The lack of broader vendor consensus and the minimal blocklist presence suggest that the campaign may be in an early stage or leveraging low‑profile hosting to avoid mass detection. Defenders should prioritize immediate mitigation by adding the domain and its resolved IP address to URL and IP deny lists, enable DNS‑based filtering for the Webflow namespace, and monitor outbound connections to Cloudflare edge nodes for anomalous patterns. Continuous re‑evaluation is advised, as additional detections or content disclosures could elevate the risk profile.