booking-com-dubai--packages[.]webflow[.]io

The domain booking-com-dubai--packages.webflow.io was registered on June 12, 2026 through the Webflow platform and currently resolves to the IP address 104.18.36.248. Analysis indicates that the domain is actively being used in a delivery‑scam campaign, as reflected by its classification in the threat profile and by its elevated risk rating. The domain has been added to one security blocklist and is blocked by the PhishDestroy service, demonstrating that at least one commercial mitigation platform has taken action against it.

VirusTotal records show that 10 of 91 scanned security vendors have flagged the domain, providing additional independent confirmation of malicious activity. No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, leaving those aspects of the infrastructure unverified at this time. The limited detection footprint—one blocklist entry and a modest number of vendor flags—suggests that the campaign may be in an early deployment stage or that the hosting provider’s reputation shields the payload from broader detection.

Defenders should prioritize network‑level blocking of the IP 104.18.36.248 and the domain name, incorporate the domain into existing phishing‑scam detection rules, and monitor for any new indicators that may emerge from the Webflow hosting environment. Ongoing observation of the domain’s DNS resolution and any changes to its hosting configuration is recommended, as shifts in infrastructure could broaden the attack surface. Given the active status and the elevated risk level, immediate remediation actions are warranted to prevent potential victim exposure to the delivery‑scam operation.