booking-comuae-dubai-desert-safari[.]webflow[.]io

As of July 29, 2026 the domain booking-comuae-dubai-desert-safari.webflow.io is classified as a generic phishing site with an elevated risk rating and an active status. Technical investigation shows the hostname resolves to the IP address 104.18.36.248, which belongs to the Cloudflare network commonly used for fast content delivery and also for malicious hosting due to its flexible DNS configuration. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has observed malicious activity associated with this host.

Registration data reveals the domain was created through the Webflow platform, a SaaS website builder that provides free subdomains under the webflow.io suffix. This registration path is frequently abused by threat actors because it bypasses traditional domain‑ownership verification steps. VirusTotal analysis reports that six out of ninety‑one scanned security vendors flag the domain as malicious, providing independent corroboration of its phishing nature.

No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available in the current dataset, leaving the exact content and lure technique of the site unverified. Defenders should prioritize adding the domain and its resolving IP to network‑level deny lists, enforce URL filtering policies that block access to webflow.io subdomains not explicitly authorized, and monitor DNS queries for similar patterns of rapid subdomain creation on the Webflow infrastructure. Continuous re‑evaluation is advised, as further indicators such as payload delivery, credential‑harvesting forms, or new vendor detections may emerge as the campaign evolves.