arabbooking-com-dubai-desert-safari[.]webflow[.]io

On July 29, 2026 the domain arabbooking-com-dubai-desert-safari.webflow.io was identified as an active malicious infrastructure supporting a generic phishing campaign. The domain is hosted on the Webflow platform, as indicated by the registrar information, and resolves to the IPv4 address 172.64.151.8. Threat intelligence sources have recorded a single blocklist inclusion, and the domain is listed by the PhishDestroy mitigation service, confirming that it has already been intercepted by at least one anti‑phishing provider.

VirusTotal analysis shows that 13 out of 91 scanned security vendors flagged the domain, demonstrating a non‑trivial detection rate across multiple engines. No additional public reputation services, such as OTX or SSL/TLS grade checks, were supplied in the available data, leaving the broader trust score and certificate details unverified. The current evidence does not reveal the specific brand or service being spoofed; the page title and visual content have not been disclosed, so the exact impersonation vector remains uncertain.

Defenders should block the resolved IP address (172.64.151.8) at network perimeter devices and add the fully qualified domain to DNS sinkhole lists. Monitoring for new DNS lookups or HTTP requests to this domain is advised, as well as continued observation of the 13 vendor detections for any escalation in threat severity. Organizations employing web‑filtering solutions should ensure the domain is included in their block policies, and incident response teams should treat any user‑reported traffic to this host as potentially malicious, prompting immediate isolation and credential compromise assessment.