desert-safaribookingcomdubai[.]webflow[.]io

Analysis indicates that desert-safaribookingcomdubai.webflow.io is an active phishing domain targeting users with a fraudulent booking service. The domain was registered through Webflow on June 12, 2026, and currently resolves to the IP address 104.18.36.248, which is associated with Cloudflare's content delivery network. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 2 out of 91 security vendors have flagged this domain as malicious, confirming its elevated risk status.

Infrastructure analysis reveals that the domain is hosted on Webflow's platform, a legitimate service often exploited for phishing due to its ease of use and free tier availability. The use of Cloudflare IP space further complicates attribution, as it obscures the true origin of the malicious content. No additional details regarding the specific brand impersonated, phishing kit, or targeted user actions are available at this time, though the domain name suggests an attempt to mimic a Dubai-based desert safari booking service. Defenders should treat this domain as an active threat.

Network-level blocking is recommended for the domain and its resolving IP, though caution is advised due to the shared nature of Cloudflare's infrastructure. Security teams are encouraged to monitor for related domains registered through Webflow or resolving to similar IP ranges, as this may indicate a broader campaign. Further investigation into the domain's content and associated infrastructure is warranted to determine the full scope of the phishing operation.