admin[.]bookingsccomdubaidesertsafari[.]webflow[.]io

The domain admin.bookingsccomdubaidesertsafari.webflow.io is actively hosting a phishing operation as indicated by multiple independent security observations. Infrastructure analysis shows that the domain resolves to the IP address 104.18.36.248, which is owned by the Webflow hosting platform and is commonly used for legitimate website publishing. The domain registration was performed through Webflow on June 12, 2026, suggesting a rapid deployment timeline typical of opportunistic phishing campaigns that leverage trusted hosting services to evade early detection.

VirusTotal scans have returned three positive detections out of ninety‑one security vendors, confirming that at least a subset of anti‑malware engines have identified malicious characteristics associated with the domain. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, providing additional evidence of its malicious intent. While the page title, brand targeting, and specific phishing lure have not been publicly disclosed, the convergence of recent creation, hosting on a reputable platform, and positive vendor detections collectively satisfy the criteria for an elevated risk rating.

Defenders should block DNS resolution to 104.18.36.248 for this host, add the fully qualified domain name to URL filtering policies, and monitor outbound traffic for attempts to contact the domain. Organizations using Webflow should audit any subdomains they control to ensure they are not inadvertently compromised. Continuous re‑evaluation is recommended as additional threat intelligence, such as further vendor detections or new blocklist entries, may surface.