booking-come-dubai-idesertsafar[.]webflow[.]io[.]webflow[.]io

Analysis indicates the domain booking-come-dubai-idesertsafar.webflow.io.webflow.io is an active generic phishing site registered through Webflow on June 12, 2026. As of July 29, 2026, the domain is listed on one security blocklist and is blocked by PhishDestroy. Infrastructure resolves to IP address 104.18.36.248, which is associated with cloud-based hosting services. VirusTotal reports that 4 of 91 security vendors have flagged this domain as malicious, though the specific detection categories and confidence levels remain unconfirmed.

No additional details regarding the page title, brand impersonation, or phishing kit are currently available, limiting further classification of the threat actor’s intended target or methodology. The domain’s creation date suggests recent deployment, aligning with typical phishing campaign timelines. The use of Webflow’s infrastructure may provide operational flexibility for threat actors, though it also increases detectability due to established monitoring of such platforms.

Defenders should prioritize blocking the domain at the DNS or proxy level, particularly in sectors handling travel, hospitality, or financial transactions, as the domain name implies a potential focus on users searching for Dubai-based services. Further investigation into associated IP ranges and SSL certificates may reveal additional linked infrastructure. Due to the elevated risk classification, organizations are advised to treat this domain as hostile until confirmed otherwise through additional analysis or takedown.