bookingdesert-safaridubai[.]webflow[.]io[.]webflow[.]io

bookingdesert-safaridubai.webflow.io.webflow.io was observed for the first time on June 12 2026 when the WHOIS record was created through the Webflow registrar. The domain resolves to the CDN address 104.18.36.248, which is associated with Cloudflare edge nodes rather than a dedicated malicious host, a pattern frequently leveraged by phishing operators to hide behind reputable infrastructure. On July 29 2026 the domain is classified as an active generic phishing campaign with an elevated risk rating.

VirusTotal has recorded detections from three out of ninety‑one scanned engines, indicating that a minority of AV products have flagged the domain as malicious. Independent threat‑intel feeds have added the domain to a single security blocklist, and the commercial phishing mitigation service PhishDestroy reports that the domain is already blocked within its network. The limited detection footprint suggests that the campaign is either newly deployed or intentionally low‑profile.

No public page title, SSL certificate details, or HTTP response codes have been published, so the exact content and credential‑harvesting tactics remain unknown. Defenders should immediately block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and consider adding the domain to internal blocklists. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in the detection profile.