booking-com-dubai-packagess[.]webflow[.]io[.]webflow[.]io

The domain booking-com-dubai-packagess.webflow.io.webflow.io was registered on June 12, 2026 through the Webflow hosting platform and resolves to the IP address 104.18.36.248. Independent monitoring services have added the domain to a security blocklist, and it is actively blocked by the PhishDestroy mitigation system. VirusTotal analysis shows that four of ninety‑one scanned security vendors flagged the domain as malicious, indicating a modest but non‑trivial detection rate.

The intelligence classification identifies the activity as a delivery‑related scam, and the risk rating is elevated while the operational status remains active. Defenders encountering traffic to this host should consider it potentially harmful and enforce existing web‑filtering or DNS‑sinkhole policies that incorporate the known blocklist entries. Inline with the observed detection, any attempts to resolve or connect to the IP should be logged and, where possible, terminated.

Network security teams should update intrusion detection signatures to reference the exact domain string and monitor for repeat connections from the same IP range. Because the domain is hosted on a legitimate web‑development service, traditional reputation checks may be less effective; therefore, reliance on the specific blocklist inclusion and the VirusTotal vendor flags is recommended for immediate mitigation. Continuous re‑evaluation is advised, as additional detection data may emerge as the campaign progresses.