demo[.]booking-comuae-dubai-desert-safari[.]webflow[.]io

Analysis of demo.booking-comuae-dubai-desert-safari.webflow.io shows a domain created on 12 June 2026 and hosted on the Webflow platform. The domain currently appears on a single security blocklist and has been actively blocked by PhishDestroy, indicating that threat‑intelligence feeds consider it malicious. VirusTotal records reveal that the domain has been scanned by 91 separate vendors; at the time of the scan no detections were reported, but the absence of positive hits does not constitute evidence of benign behavior.

No additional infrastructure details such as IP address, ASN, or geographic hosting information are available from the supplied intelligence. The lack of a published page title or observed brand identifiers means that the specific content presented to victims has not yet been catalogued. Consequently, while the domain’s registration via Webflow and its presence on a blocklist provide concrete indicators of phishing intent, the exact tactics, techniques, and procedures employed by the actors remain uncertain.

Defenders should continue to block the domain at network perimeter controls, update URL filtering policies to include it, and monitor for any emerging indicators such as new host resolution or changes in SSL certificate usage. Ongoing observation of threat‑intel feeds for additional detections or reputation changes is recommended, as further evidence may clarify the scope and targeting of the campaign.