sso[.]booking-dubai-desert-safaria[.]webflow[.]io

Analysis as of July 29, 2026 shows that the domain sso.booking-dubai-desert-safaria.webflow.io is actively used in a generic phishing operation. The domain was registered through the Webflow platform on June 12, 2026, indicating a very recent creation timeline. It is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, which suggests that at least one anti‑phishing feed has identified malicious activity tied to the host.

VirusTotal data records that two out of ninety‑one security vendors have flagged the domain, providing independent corroboration of its suspicious nature. The limited vendor consensus, combined with the blocklist entry, aligns with the elevated risk rating assigned to the domain. No public IP address, autonomous system number, or geographic hosting information is available in the supplied intelligence, and SSL certificate details or HTTP response codes have not been disclosed, leaving those infrastructure aspects unverified.

Defenders should therefore treat any traffic to or from this domain as potentially malicious. Recommended mitigations include adding the domain to outbound filtering rules, ensuring that security appliances reference the PhishDestroy blocklist, and monitoring for any future increases in detection counts on aggregators such as VirusTotal. Continuous re‑evaluation is advised, as additional observations—such as hosting metadata or content analysis—may emerge and adjust the threat posture.