shop[.]booking-comaeu-dubai-packages[.]webflow[.]io

Analysis of the domain shop.booking-comaeu-dubai-packages.webflow.io, observed on July 29, 2026, indicates an active delivery‑scam infrastructure with an elevated risk rating. The domain was registered on June 12, 2026 through the Webflow platform, a legitimate website‑building service that often provides shared hosting and CDN services. DNS resolution points to the IP address 104.18.36.248, an address associated with Cloudflare's edge network, suggesting the attacker is leveraging Cloudflare's infrastructure to mask the true origin of the traffic.

VirusTotal reports that nine of ninety‑one security vendors have flagged the domain, providing modest but notable detection consensus across multiple scanning engines. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the notion that it is being used for malicious purposes. No public page title, SSL certificate details, or HTTP response codes are presently available, limiting the depth of content‑level analysis.

The lack of additional contextual data—such as observed landing page content, credential‑capture forms, or affiliate identifiers—means the precise tactics employed in the delivery scam remain uncertain. Defenders should treat this indicator as hostile: block the domain at network perimeters, update URL filtering and threat‑intel feeds, and monitor for related subdomains or IP addresses that resolve to the same Cloudflare edge node. Continuous re‑evaluation is advised, as the attacker may modify the hosting configuration or employ additional domains to evade detection.