booking-com-dubai-desert--safarii[.]webflow[.]io

The domain booking-com-dubai-desert--safarii.webflow.io was registered on 12 June 2026 via the Webflow platform, a service that provides website hosting and design tools. DNS resolution points to the IP address 172.64.151.8, which is consistent with Cloudflare edge nodes commonly used by Webflow customers. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, indicating that at least one trusted sinkhole has identified malicious activity associated with this host.

VirusTotal analysis shows that 13 of 91 scanning engines flag the domain, a detection rate that suggests a non‑trivial likelihood of abuse despite a majority of scanners not raising an alert. No public SSL certificate details, HTTP status codes, or page title information are available in the current intelligence set, and the page content has not been publicly dissected. Consequently, the precise phishing payload or credential‑harvesting technique employed by the site remains uncertain.

Defensive teams should treat the domain as hostile: add the host to outbound URL filtering rules, enforce DNS blocklists that include the observed entry, and monitor for any outbound connections to 172.64.151.8 from internal assets. Because the domain is hosted on a shared infrastructure, broader network‑level controls such as IP reputation filters can help reduce exposure. Continuous re‑evaluation is advised, as additional detection vendors may update their verdicts and further forensic analysis could reveal the exact phishing scenario being leveraged.