bookingndubaipackages[.]webflow[.]io[.]webflow[.]io

The domain bookingndubaipackages.webflow.io.webflow.io was created on 12 June 2026 via the Webflow hosting platform and is currently classified as a delivery‑scam infrastructure. Early detection by the PhishDestroy sinkhole indicates that the domain is actively used in malicious campaigns aimed at deceiving victims with false delivery notifications. VirusTotal analysis shows that four of ninety‑one security vendors flagged the domain, suggesting the presence of malicious indicators that have not yet triggered broader consensus.

The domain is listed on a single external blocklist, reinforcing the view that it has been observed in at least one security feed. No additional intelligence such as page title, SSL certificate details, or hosting IP reputation is available in the current dataset, leaving the exact payload and victim interaction flow unconfirmed.

Defenders should prioritize containment by adding the fully qualified domain to network and DNS blocklists, monitoring for any outbound connections to the hosting provider, and correlating logs for traffic to Webflow‑hosted subdomains that match the observed pattern. Continuous re‑evaluation is advised as further telemetry becomes available, particularly regarding the content served by the site and any associated command‑and‑control endpoints.