booking-com-dubaii-packages[.]webflow[.]io

The domain booking-com-dubaii-packages.webflow.io was registered through the Webflow platform on 12 June 2026. Infrastructure analysis shows the hostname resolves to the IP address 172.64.151.8, which is associated with Cloudflare’s edge network and does not reveal a dedicated backend server. VirusTotal has recorded two positive detections out of ninety‑one scanned security vendors, indicating that a minority of AV engines have identified malicious behavior linked to the domain. The site is currently listed on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that at least one defensive organization considers the domain to be abusive.

The threat classification supplied by the reporting feed labels the activity as a “delivery scam,” and the risk level is elevated, with the campaign still marked as active. Evidence is limited to the registration metadata, the IP resolution, and the partial VirusTotal detections. No public information is available regarding the page title, TLS certificate details, or HTTP response codes, and the content of the landing page has not been captured in the intelligence set. Consequently, the precise tactics employed by the actors—such as credential harvesting, payment diversion, or package tracking manipulation—remain unverified.

Defenders should prioritize adding the domain to outbound filtering rules and ensure that any traffic to the IP 172.64.151.8 is inspected or blocked in accordance with organizational policy. Monitoring for additional detections from other sandbox or AV services is advisable, as the low detection count may evolve as more samples are analyzed. Organizations that routinely receive package delivery notifications should educate users about the possibility of fraudulent communications referencing the domain, and incident response teams should treat any related alerts as high‑confidence indicators of compromise given the elevated risk rating.