booking-comaeu-dubai-packages[.]webflow[.]io

The domain booking-comaeu-dubai-packages.webflow.io was registered on June 12, 2026 through the Webflow platform and currently resolves to the IP address 172.64.151.8. Analysis shows that twelve of ninety‑one security vendors on VirusTotal have flagged the domain as malicious, indicating a moderate level of detection confidence. The domain is listed on a single external security blocklist and has been actively blocked by the PhishDestroy service, which suggests that at least one reputable sink‑hole has identified it as a delivery‑related scam. The threat profile is classified as a delivery scam, and the risk level is elevated while the operational status remains active as of the report date, July 29, 2026.

Concrete evidence includes the registration timestamp, the Webflow registrar association, the IP resolution, and the multi‑vendor detection count. No publicly available information is present regarding SSL certificate details, HTTP response codes, Safe Browsing or Open Threat Exchange entries, page title, or additional intelligence feeds, so those aspects remain unknown. The limited blocklist presence (one list) and the partial vendor flagging highlight that the domain may not yet be universally recognized across all defensive platforms, raising the possibility of false negatives in some environments.

Defenders should prioritize immediate containment by adding the domain and its resolved IP address to network‑level deny lists and updating email filtering rules to drop any messages referencing the domain. Continuous monitoring of the IP 172.64.151.8 for new activity, as well as periodic re‑scans on VirusTotal and other sandbox services, is recommended to capture any evolution in payload or hosting changes. Organizations employing Webflow‑based content should verify that any internal use of the platform does not inadvertently whitelist this subdomain.