bookingcom-dubaipackages[.]webflow[.]io

Analysis indicates that the domain bookingcom-dubaipackages.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. The site resolves to the IP address 172.64.151.8, which is owned by the Cloudflare network and is commonly used for legitimate content delivery as well as for malicious hosting. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming that defensive feeds have identified it as malicious. VirusTotal reports that three of ninety‑one scanning engines have flagged the domain, providing additional independent confirmation of suspicious activity. The threat classification supplied is a delivery‑scam campaign, and the risk level is elevated with an active status as of the report date, July 29, 2026.

Evidence beyond the listed indicators is not currently available; no public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts have been disclosed. Consequently, the precise content and tactics employed by the site remain unknown, and analysts cannot confirm whether the domain is currently serving phishing pages, malicious downloads, or other fraudulent content. The limited visibility of the infrastructure suggests that the operators may be leveraging the rapid deployment capabilities of Webflow to host a short‑lived scam page. Defenders should add the domain to blocklists and enforce DNS filtering for the exact hostname.

Network monitoring should flag any outbound connections to 172.64.151.8, especially from endpoints that handle package tracking or delivery notifications. Because the domain uses a reputable CDN, standard reputation‑based controls may not trigger; therefore, rule‑based blocking based on the fully qualified domain name is recommended. Continuous re‑evaluation is advised, as the site could change its payload or hosting configuration.