booking-com-dubai-desert--safarii[.]webflow[.]io[.]webflow[.]io

The domain booking-com-dubai-desert--safarii.webflow.io.webflow.io was registered on June 12, 2026 through the Webflow platform, a service often used for rapid site deployment. DNS resolution points to the IP address 104.18.36.248, indicating that the site is being served from a shared hosting environment typical of content delivery networks. Threat intelligence feeds have placed the domain on a single security blocklist, and PhishDestroy has actively blocked the host, confirming its use in malicious campaigns.

VirusTotal analysis shows that four of ninety‑one scanning engines have raised detections, suggesting that at least a minority of scanners recognize the domain as malicious, though the majority have not flagged it. The limited but consistent evidence points to a generic phishing operation, likely leveraging the brand‑related naming pattern to lure victims into credential‑stealing interactions. What remains uncertain includes the exact payload delivered, the presence of SSL certificates, HTTP response codes, and any additional hosting infrastructure beyond the observed IP.

Defenders should add the domain to inbound and outbound filters, monitor DNS queries for the 104.18.36.248 address, and incorporate the blocklist entry into their threat‑feed integrations. Continuous re‑scanning with VirusTotal or similar services is advisable to capture any changes in detection scores, and any observed traffic to the domain should be logged and investigated for credential exposure or malware download attempts.