urlkey[.]booking-comdubaicom-packages[.]webflow[.]io

The domain urlkey.booking-comdubaicom-packages.webflow.io was registered on June 12, 2026 through the Webflow platform, a service that provides hosted website building and content delivery. The domain resolves to the IP address 104.18.36.248, which belongs to a cloud hosting provider commonly used for legitimate content but also frequently abused by threat actors for short‑lived phishing or delivery‑scam infrastructure. On July 29, 2026 the domain was listed as active and classified as a delivery scam with an elevated risk rating. Defensive feeds have already flagged the host: PhishDestroy has blocked the domain, and it appears on one additional security blocklist.

VirusTotal analysis shows that 2 of 91 scanned security vendors flagged the domain, indicating that at least a small subset of scanners detect malicious characteristics, though the majority did not raise an alert. The limited detection count suggests the site may be newly deployed or employing evasion techniques that avoid broader detection. No further public intelligence such as Safe Browsing alerts, OTX mentions, or SSL certificate details were available at the time of analysis.

Given the combination of recent creation, association with a delivery‑scam campaign, and partial vendor detection, defenders should treat the domain as hostile. Recommended mitigations include adding the domain and its resolving IP 104.18.36.248 to network blocklists, monitoring DNS queries for the full hostname, and applying URL filtering rules that deny traffic to any Webflow‑hosted subdomains not explicitly authorized. Continuous re‑evaluation is advised, as additional detections or blocklist listings may emerge as the campaign matures.