booking-com-dubbbaai-packages[.]webflow[.]io

This domain, booking-com-dubbbaai-packages.webflow.io, was registered on June 12, 2026 through the Webflow hosting platform. DNS resolution points to the IP address 104.18.36.248, which is part of a cloud‑based content delivery network commonly used for legitimate sites but also abused by malicious actors to hide origin. The site is currently flagged by two of ninety‑one security vendors on VirusTotal, indicating that at least a small subset of scanners have detected malicious characteristics. It is listed on a public blocklist and has been added to the PhishDestroy watchlist, suggesting that community‑driven defenses have observed abusive activity.

The threat type is identified as a delivery‑scam, implying that the site likely attempts to collect payment or personal information under the pretense of shipping a package. No public SSL certificate details, HTTP status codes, or page‑title information are available in the provided intelligence, so the presence of HTTPS, redirection behavior, or content cues remain unknown. Defenders should treat the domain as hostile: block DNS resolutions to 104.18.36.248 when associated with this hostname, add the full FQDN to URL filtering and intrusion‑prevention policies, and monitor outbound traffic for attempts to contact the domain.

Because the site leverages a reputable CDN, additional heuristic checks such as anomalous request patterns, unusual user‑agent strings, or sudden spikes in traffic to this host may help surface abuse. Organizations that handle deliveries or e‑commerce transactions should educate users about unsolicited package offers that reference Booking.com, and enforce verification steps before any payment is made. Continuous re‑evaluation is advised, as further analysis (e.g., retrieving the page title, SSL certificate, or sandbox behavior) could reveal additional indicators of compromise.