learn[.]bookingcomrestaurants-dubai[.]webflow[.]io

The domain learn.bookingcomrestaurants-dubai.webflow.io was registered on June 12, 2026 through the Webflow platform, a service that frequently hosts user‑generated sites. Within weeks of creation the domain was added to a security blocklist and was subsequently blocked by the PhishDestroy sinkhole, indicating that it is being used for malicious purposes. VirusTotal scans show that three of ninety‑one antivirus engines flagged the domain, confirming that at least a minority of detection products consider the site suspicious.

The domain currently appears on one public blocklist, reinforcing the assessment that it is part of active phishing infrastructure. No additional intelligence such as IP address, ASN, or SSL certificate details has been publicly released, so the hosting environment and network location remain unknown. The limited detection coverage combined with the early blocklist entry suggests a short‑lived, opportunistic campaign, likely targeting users of the Booking.com restaurant service by exploiting the Webflow sub‑domain pattern.

Defenders should add the domain to local deny lists, monitor DNS queries for the exact name, and consider extending blocklist subscriptions that already flag it. Because the site is hosted on a shared Webflow infrastructure, any compromise of the underlying account could be revoked by the hosting provider; contacting Webflow for takedown may expedite remediation. Until further evidence emerges, the domain should be treated as an active, elevated‑risk phishing indicator.