help[.]booking-comdubaicom-packages[.]webflow[.]io

This domain, help.booking-comdubaicom-packages.webflow.io, is under investigation for delivery scam activity as of July 29, 2026. Registered on June 12, 2026, through Webflow, the domain currently resolves to IP address 104.18.36.248. Analysis indicates it appears on one security blocklist, specifically PhishDestroy, which has flagged it for malicious behavior. No detections are recorded by the 91 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm safety.

The domain's infrastructure is hosted on Webflow's platform, a common choice for rapidly deployed phishing sites due to its ease of use and free tier availability. Defenders should note that the domain's naming convention—combining 'booking' and 'dubai' with 'packages'—suggests an attempt to impersonate a legitimate travel or logistics service, aligning with the reported delivery scam classification. However, the exact content and targeting of the site remain unconfirmed, as no page title, brand target, or phishing kit details are available in current intelligence. The domain's active status and presence on a blocklist warrant immediate monitoring and potential blocking in enterprise environments.

Organizations should correlate this domain with internal logs for any user interactions or attempted access. If additional telemetry indicates user engagement, incident response procedures should be initiated to assess potential compromise. Given the domain's recent creation and limited detection history, further analysis of its hosting IP and associated domains may reveal additional related infrastructure.