booking-com-duubai-desert-safari[.]webflow[.]io

Analysis of the domain booking-com-duubai-desert-safari.webflow.io indicates it is an active phishing site impersonating Booking.com, targeting users with fraudulent travel or safari booking services. The domain was registered on June 12, 2026, through Webflow, a platform commonly used for legitimate web development but also exploited for hosting phishing pages. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, which is associated with cloud-based hosting services, though no specific autonomous system number (ASN) or geolocation details were provided. As of July 29, 2026, the domain appears on a single security blocklist, specifically PhishDestroy, suggesting initial detection but limited broader visibility across threat intelligence platforms.

VirusTotal analysis shows that 2 out of 91 security vendors flag this domain as malicious, indicating low but present detection coverage. The exact content of the phishing page remains unconfirmed, as no page title, brand confirmation, or phishing kit details were provided in the available intelligence. However, the domain name structure strongly suggests an attempt to deceive users into believing it is affiliated with Booking.com, a well-known travel booking platform. Defenders should treat this domain as an elevated-risk threat due to its active status, impersonation of a trusted brand, and partial detection by security vendors.

Recommended actions include blocking the domain at the DNS or network level, adding it to internal blocklists, and monitoring for connections to the associated IP address 104.18.36.248. Security teams should also review logs for any user interactions with this domain, particularly in regions where Booking.com services are commonly used. Further investigation into the hosting infrastructure may reveal additional related domains or campaigns.