bookingcompackages-dubai[.]webflow[.]io

bookingcompackages-dubai.webflow.io is currently classified as an active delivery‑scam infrastructure with an elevated risk rating. The domain resolves to the IP address 104.18.36.248, which is owned by Cloudflare and commonly used by sites built on the Webflow platform; the registration record shows the site was created through Webflow’s hosted service. Independent scanning on VirusTotal returned a detection ratio of 2 / 91 security vendors, indicating that two scanners identified malicious characteristics while the majority did not flag the host. The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy remediation feed, confirming that at least one operational security service has observed abusive activity associated with the host.

No additional public intelligence such as SSL fingerprint, HTTP response codes, or page‑title information is available, so the visual or functional content of the site cannot be corroborated at this time. The limited detection footprint suggests a low‑profile hosting configuration, but the presence on a dedicated phishing blocklist indicates purposeful abuse. The combination of Cloudflare’s shared IP space and the Webflow registration obscures direct attribution to a single operator, a tactic frequently employed by delivery‑scam actors to leverage reputable infrastructure.

Because the domain is still active, threat hunters should query recent DNS logs for look‑alike patterns and correlate any user‑reported receipt or tracking notifications that reference “bookingcompackages” with this host. Analysts should prioritize adding 104.18.36.248 and the fully qualified domain name to network‑level deny lists, monitor DNS queries for repeated resolution, and consider employing sink‑hole techniques for any outbound connections originating from internal assets.