test[.]bookingcompackages-dubai[.]webflow[.]io

On July 29, 2026, the domain test.bookingcompackages-dubai.webflow.io was identified as an active delivery‑scam infrastructure with an elevated risk rating. The domain was registered through the Webflow platform on June 12, 2026 and resolves to the IPv4 address 172.64.151.8. Threat intelligence indicates that the domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis shows that one out of ninety‑one scanning engines flagged the domain, confirming the presence of malicious content.

No additional public detections or reputation scores are available beyond these observations. The limited detection surface suggests that the campaign may be in an early stage or employing low‑profile hosting. Defenders should continue to monitor the IP address and blocklist entries, enforce outbound filtering for the domain, and consider adding the host to internal deny lists.

Because the underlying content has not been publicly examined, the exact payload and victim‑interaction mechanisms remain uncertain. Ongoing collection of HTTP response headers, SSL certificate details, and page title metadata is recommended to refine the attribution and to support automated detection rules. Until further evidence emerges, the domain should be treated as malicious and excluded from user‑facing services.