urlkey[.]booking-comaeu-dubai-packages[.]webflow[.]io

Analysis indicates that the domain urlkey.booking-comaeu-dubai-packages.webflow.io was registered on June 12 2026 through the Webflow platform. The domain resolves to the IP address 172.64.151.8, which is part of the Cloudflare network used by many Webflow‑hosted sites. The infrastructure has been observed on a single public blocklist; PhishDestroy currently lists the domain as blocked. VirusTotal reports that nine out of ninety‑one scanning engines have generated a detection for the domain, reinforcing the suspicion of malicious activity. No additional public intelligence such as Safe Browsing, OTX, or SSL certificate details is presently available, and the page title and content have not been publicly disclosed.

The limited evidence points to a delivery‑related scam, consistent with the “delivery scam” classification supplied. The recent creation date and rapid appearance on a blocklist suggest an opportunistic campaign that leverages the trusted appearance of a Booking.com‑style sub‑domain to lure victims. Defenders should update perimeter defenses to deny traffic to 172.64.151.8 and any sub‑domains of booking‑comaeu‑dubai‑packages.webflow.io. Email filtering rules that flag URLs containing “booking‑comaeu‑dubai‑packages” or the full domain string are recommended.

Continuous monitoring of the IP address for new hostnames and periodic re‑scans on VirusTotal or similar services will help capture any evolution of the payload. Organizations that employ web‑proxy or DNS‑level filtering should add the domain to their deny lists immediately. Because the hosting provider is Webflow, requests for takedown can be directed to their abuse contact to accelerate removal. Until further forensic analysis of the landing page is released, the domain should be treated as high‑confidence malicious.