aebooking-com-dubai-desert-safari[.]webflow[.]io

The domain aebooking-com-dubai-desert-safari.webflow.io was registered on June 12, 2026 through the Webflow platform and resolves to the IP address 172.64.151.8. VirusTotal analysis shows that 13 of 91 security vendors have flagged the domain, indicating a moderate level of detection across independent scanners. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes. Current threat intelligence classifies the activity as generic phishing with an elevated risk rating and an active status.

No additional public intelligence such as brand targeting, specific kit identifiers, or detailed page‑title analysis is available at this time, so the precise content of the hosted page remains unknown. Infrastructure analysis suggests the hosting provider is Webflow, a legitimate web‑hosting service often abused by threat actors to gain a trusted TLS certificate and a reputable CDN edge. The IP address 172.64.151.8 belongs to a cloud edge network, making attribution to a single operator difficult.

Defenders should prioritize immediate blocking of the domain at perimeter and DNS filtering layers, extend blocks to the associated IP range, and monitor for any related C2 traffic patterns. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations should also update threat‑intel feeds to include this indicator and consider sharing the observation with industry‑wide blocklist providers to enhance collective defenses.