booking-com-dubai-desert-safar[.]webflow[.]io

On 12 June 2026 the sub‑domain booking-com-dubai-desert-safar.webflow.io was registered through the Webflow platform. DNS resolution points to the address 172.64.151.8, which is owned by the Cloudflare network and commonly used for hosting user‑generated sites. VirusTotal has recorded two positive detections out of ninety‑one submitted security scanners, indicating that a minority of AV engines have flagged the domain as malicious. The same domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one anti‑phishing feed considers it abusive.

The threat is classified as generic phishing and the current risk rating is elevated; the campaign remains active according to the latest intelligence timestamp of 29 July 2026. The available evidence does not provide details about the page content, SSL certificate, HTTP response codes, or any observed credential‑capture infrastructure beyond the domain name itself. Consequently, defenders cannot confirm the exact phishing vector or the targeted brand beyond the domain’s naming pattern.

Organizations should add the host IP 172.64.151.8 to network deny lists, enforce DNS filtering for the full domain string, and monitor outbound connections to Cloudflare edge nodes that resolve to this address. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in detection counts. Integration of the blocklist entry from PhishDestroy into existing email and web gateway filters will help prevent end‑user exposure while further investigation is conducted.