booking-com-aeudubai-desert-safari[.]webflow[.]io

The domain booking-com-aeudubai-desert-safari.webflow.io was observed resolving to the IPv4 address 172.64.151.8. That address is allocated to Cloudflare, indicating the site is hosted behind a widely used content‑delivery network rather than a dedicated infrastructure. Registration metadata shows the domain was created through the Webflow SaaS platform, a service that supplies hosting and site‑building tools to a broad customer base. No independent ownership information is disclosed, and the registrant’s contact fields are not publicly visible, a characteristic frequently leveraged by malicious operators to obscure attribution.

Threat‑intel feeds have flagged the domain on a single security blocklist and it is explicitly listed as blocked by the PhishDestroy mitigation service. VirusTotal scanning reports that five of ninety‑one anti‑malware engines returned a positive detection for the domain, indicating that a minority of scanners have identified malicious characteristics, though the majority did not flag it. The limited vendor consensus suggests the payload or content may be evasive or that the detection signatures are still emerging.

The domain name itself incorporates the brand name "booking-com", a clear attempt to suggest affiliation with the well‑known travel booking service. No public page title, brand‑target confirmation, or landing‑page screenshot has been released in the current intelligence set, so the exact phishing lure (e.g., credential‑harvest form, malicious download, or counterfeit booking confirmation) remains unverified. Consequently, defenders should treat the domain as a potential credential‑stealing vector aimed at users of the Booking.com service.

Recommended defensive actions include adding the domain to firewall and DNS blocklists, monitoring outbound connections to the associated IP address, and enabling URL filtering that references the PhishDestroy blocklist entry.