booking-come-dubai-idesertsafar[.]webflow[.]io

booking-come-dubai-idesertsafar.webflow.io was registered on June 12 2026 through the Webflow platform. The domain resolves to the IP address 104.18.36.248, which is part of the Cloudflare network commonly used for hosting web content. Early detection activity shows the domain listed on a single security blocklist and specifically blocked by PhishDestroy.

VirusTotal analysis reports that two of ninety‑one scanned security vendors have flagged the domain, indicating a non‑trivial likelihood of malicious intent. The limited blocklist presence and the modest vendor detection count suggest that the site is newly deployed and may be in the early stages of a phishing campaign targeting users with travel‑related lures, as implied by the “booking‑come‑dubai‑idesertsafar” naming pattern. However, without a publicly available page title, content snapshot, or SSL certificate metadata, the exact phishing vector, credential‑harvesting mechanism, and targeted brand remain undetermined.

Defenders should add the domain to local deny lists, monitor DNS queries for the 104.18.36.248 address, and enforce URL filtering rules that block any request to the host. Network traffic to the IP should be inspected for anomalous HTTP requests, and any credential submissions observed should be treated as compromised. Continuous re‑evaluation is advised, as additional detections or blocklist listings may appear as the campaign matures.