booking-comdubaicom-packages[.]webflow[.]io

The domain booking-comdubaicom-packages.webflow.io is currently flagged as part of an active delivery‑scam campaign. Registration details show the site was created through the Webflow hosting platform, which is consistent with the observed use of the sub‑domain “.webflow.io”. Infrastructure analysis reveals that the domain resolves to IP address 104.18.36.248, an address owned by Cloudflare, indicating that the attacker is leveraging a reputable CDN to mask the true location of the malicious server. Reputation services have recorded the domain on a single security blocklist and it is listed as blocked by the PhishDestroy service.

VirusTotal scans report that four out of ninety‑one antivirus engines have identified the domain as malicious, providing limited but notable detection confidence. No public Safe Browsing, Open Threat Exchange, or SSL certificate information is presently available for this host, and no page title or content metadata has been disclosed by the intelligence feed. Consequently, while the presence of blocklist entries and multiple vendor detections confirms a level of threat, the limited visibility into the site’s payload and user‑facing content creates uncertainty about the exact delivery‑scam mechanisms employed.

Defenders should add the domain to outbound‑traffic filtering rules, monitor DNS queries for the 104.18.36.248 address, and enforce blocklist updates that include the PhishDestroy entry. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution in the threat profile, and any observed attempts to deliver counterfeit delivery notifications should be treated as high‑confidence indicators of compromise. Email security gateways should quarantine messages referencing this domain and user awareness programs should warn against unsolicited delivery confirmations.