blog[.]booking-comuae-dubai-desert-safari[.]webflow[.]io

Analysis of the domain blog.booking-comuae-dubai-desert-safari.webflow.io indicates it is an active phishing resource targeting users of the Booking.com travel platform. The domain was registered on June 12, 2026, through Webflow, a legitimate platform often exploited for hosting phishing content due to its free tier and ease of deployment. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, which is part of a cloud hosting range frequently associated with malicious activity, though not exclusively so. As of July 29, 2026, the domain appears on one security blocklist, suggesting preliminary detection by at least one vendor, while PhishDestroy has already flagged it for blocking.

Notably, the domain has been scanned by 91 security vendors on VirusTotal, with no detections currently reported; however, the absence of detections does not confirm safety, particularly given the domain's recent registration and limited exposure. The domain name itself contains multiple red flags: the inclusion of 'booking-comuae' suggests an attempt to impersonate Booking.com, a well-known travel booking service, while the addition of 'dubai-desert-safari' may be intended to lend credibility to a localized or themed phishing lure. No specific phishing kit or brand confirmation from page content is available at this time, as the exact content of the site has not been analyzed.

Defenders should treat this domain as high-risk for phishing activity targeting Booking.com credentials or payment information. Organizations are advised to block the domain at the DNS or proxy level and monitor for related infrastructure, such as subdomains or newly registered domains using similar naming conventions. Further investigation is warranted to determine the scope of the campaign and any associated threat actor infrastructure.