booking-com-dubai-desert-safari[.]webflow[.]io

The domain booking-com-dubai-desert-safari.webflow.io was registered on June 12, 2026 and is hosted on the Webflow platform, resolving to the IP address 172.64.151.8, which belongs to a Cloudflare‑owned range commonly used for content delivery and site hosting. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal analysis shows that two out of ninety‑one scanned security vendors flagged the domain, providing additional corroboration of its suspicious nature. The overall risk rating is elevated and the status is listed as active, suggesting the site is currently being used in a phishing campaign.

No public information is available regarding the page title, SSL certificate details, or the exact payload delivered to victims, and the content of the site has not been examined. Consequently, defenders lack concrete insight into the specific lures or credential‑stealing mechanisms employed. Given the confirmed hosting on a legitimate SaaS platform, the malicious activity likely relies on the platform’s ability to host arbitrary HTML, enabling rapid deployment of deceptive pages.

To mitigate exposure, security teams should immediately add the full domain to URL filtering and web proxy block lists, enforce DNS‑based blocking where possible, and monitor outbound traffic for connections to the associated IP address. Incident response teams should also consider hunting for any recent authentication attempts or credential submissions that may have been directed at this domain, and, if observed, trigger credential‑reset procedures for affected accounts. Continuous monitoring of threat intelligence feeds for additional indicators tied to the same IP or hosting provider is recommended to detect subsequent campaigns that may reuse the same infrastructure.