affiliates[.]bokingcodubai[.]webflow[.]io

This domain, affiliates.bokingcodubai.webflow.io, is flagged as an active phishing threat targeting Booking.com users. Registered on June 12, 2026, through Webflow, the domain resolves to IP address 172.64.151.8. Analysis indicates it has been blocked by PhishDestroy and appears on at least one security blocklist, reinforcing its elevated risk classification. Only one of 91 security vendors on VirusTotal has flagged the domain, suggesting either early-stage detection or limited visibility in automated scanning systems.

The domain's infrastructure, hosted on Webflow's platform, aligns with common phishing tactics leveraging legitimate cloud services to evade initial scrutiny. No additional details regarding the specific content, phishing kit, or targeted brand elements beyond the domain name itself are currently available. The domain's structure, incorporating 'bokingcodu'—a likely misspelling of 'Booking.com'—strongly suggests intent to deceive users into believing they are interacting with the legitimate Booking.com affiliate program.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level. Organizations using Webflow-hosted domains for legitimate purposes should verify their own assets to ensure they are not inadvertently associated with this phishing infrastructure. Further investigation into the domain's HTTP responses, SSL certificate details, and any linked resources is recommended to identify additional indicators of compromise or infrastructure reuse.