dashboard[.]bookingsccomdubaidesertsafari[.]webflow[.]io

Analysis as of July 29 2026 flags the sub‑domain dashboard.bookingsccomdubaidesertsafari.webflow.io as an active credential‑harvesting infrastructure. The domain was created on June 12 2026 and registered through Webflow, a SaaS website‑building service that also supplies DNS and CDN hosting. Its sole A‑record points to 104.18.36.248, an IP range operated by Cloudflare, which suggests the site leverages Cloudflare’s edge network for content delivery and possibly for obscuring origin details. VirusTotal records three positive detections out of ninety‑one scanners, indicating that a minority of security engines have identified malicious characteristics, though the majority have not flagged the host.

The domain is present on one external blocklist and is explicitly blocked by the PhishDestroy service, providing independent confirmation of phishing‑related abuse. No public Safe Browsing verdicts, Open Threat Exchange (OTX) tags, SSL certificate information, HTTP response codes, or page‑title metadata have been published for this host, leaving the exact phishing lure, target brand, and payload type undefined. The limited intelligence therefore creates uncertainty around the campaign’s scale, the presence of additional malicious sub‑domains, and whether the site is part of a broader phishing kit.

Defensive guidance recommends immediate containment: add the full host name and its parent zone to DNS‑sinkhole or firewall blocklists, enforce proxy filtering for the resolved IP address 104.18.36.248, and monitor outbound traffic for TLS connections to Cloudflare edge nodes that may be used to relay credential submissions. Security teams should also track updates from VirusTotal, PhishDestroy, and other blocklist providers, as additional detections could raise the risk profile. Continuous log review and threat‑intel correlation are essential to detect any evolution of the infrastructure.