desertsafari-bookingcomdubai[.]webflow[.]io

Analysis as of July 29, 2026 indicates that the domain desertsafari-bookingcomdubai.webflow.io is actively resolving to the IP address 104.18.36.248. The IP belongs to a content‑delivery network commonly used for legitimate web traffic, suggesting the adversary is leveraging a reputable hosting provider to increase the likelihood of successful delivery. Registration metadata shows the domain was created through the Webflow service, a platform that offers easy website publishing and often allows rapid deployment of malicious pages.

The domain has been added to a security blocklist and is reported as blocked by the PhishDestroy feed, demonstrating that at least one trusted feed has identified it as malicious. VirusTotal analysis shows that 7 of 91 security vendors have flagged the domain, providing independent corroboration of its malicious status. No additional public evidence such as page title, SSL certificate details, or observed phishing lure content is presently available, leaving the exact luring technique and targeted brand undefined.

Defenders should treat the domain as high‑risk: incorporate the domain and its resolving IP into perimeter blocklists, update email gateway and web‑proxy filters to deny traffic, and monitor for any related subdomains or similar Webflow‑registered URLs. Continuous re‑assessment is advised, as the threat actor may alter hosting or page content while retaining the same registration path.