booking-com-dubai-desert-safffari[.]webflow[.]io

Analysis of booking-com-dubai-desert-safffari.webflow.io confirms its classification as an active phishing domain targeting Booking.com customers. The domain was registered on June 12, 2026, through Webflow's hosting platform and currently resolves to IP address 172.64.151.8. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports indicate that 2 out of 91 security vendors flag this domain as malicious, providing initial detection coverage but suggesting that broader industry recognition remains limited.

Infrastructure analysis reveals the domain is hosted on Webflow's content delivery network, which is frequently abused for rapid phishing site deployment due to its ease of registration and SSL certificate automation. The use of 'booking-com' in the subdomain, combined with 'dubai-desert-safffari,' suggests an attempt to deceive users searching for legitimate Booking.com travel services, particularly desert safari tours in Dubai. No specific phishing kit or page content has been analyzed at this time, so the exact credential harvesting mechanism remains unconfirmed. Defenders should treat this domain as an elevated-risk threat due to its active status, brand impersonation, and detection by multiple security layers.

Network-level blocking is recommended, particularly for organizations in the travel, hospitality, or e-commerce sectors. Security teams should monitor for additional domains using similar naming conventions (e.g., 'booking-com-[location]-[activity]') registered through Webflow or other low-friction hosting providers. Further investigation into the IP address 172.64.151.8 may reveal additional malicious domains sharing the same infrastructure.