bookingcommdubaipackagess[.]webflow[.]io

The domain bookingcommdubaipackagess.webflow.io was registered on June 12, 2026 through the Webflow platform. Infrastructure analysis shows the hostname resolves to the IP address 172.64.151.8, which is part of the public cloud network used by Webflow for hosting customer sites. The domain appears on a single external blocklist and has been flagged by the PhishDestroy feed, indicating that it is currently being used in an active delivery‑scam campaign.

VirusTotal reports that two out of ninety‑one scanned security vendors have generated a detection for the domain, reinforcing the suspicion of malicious activity. No additional public reputation signals such as Safe Browsing alerts, Open Threat Exchange entries, or SSL certificate anomalies are present in the available data. The limited detection surface suggests that the campaign may be in an early stage or that the payload is hosted on the same Cloudflare‑backed infrastructure, reducing exposure to traditional scanners.

Defenders should block the domain at network perimeter devices, update DNS filtering policies to include the observed IP address, and monitor for any outbound connections to the host. Because the Webflow service is commonly used for legitimate sites, blanket blocking of the entire provider may cause collateral impact; therefore, a targeted blocklist entry for the specific hostname is recommended. Continuous re‑evaluation is advised, as additional detections may appear if the campaign expands its infrastructure or if further analysis uncovers malicious payloads hosted on the site.