urlkey[.]bokingcodubai[.]webflow[.]io

The domain urlkey.bokingcodubai.webflow.io was registered on June 12, 2026 through the Webflow hosting platform. Within days of its creation it was observed on a single security blocklist and subsequently added to the PhishDestroy blacklist. VirusTotal scans show that one out of ninety‑one security vendors flagged the domain, indicating at least one detection of malicious activity.

The limited detection footprint suggests a nascent campaign that may still be expanding its infrastructure. Current open‑source intelligence does not reveal the hosting IP address, ASN, or geographic location, and no SSL certificate details, HTTP response codes, or Safe Browsing verdicts have been published. The absence of additional blocklist listings, combined with the early stage of detection, leaves the full scope of the phishing operation uncertain.

Analysts recommend that defenders add urlkey.bokingcodubai.webflow.io to outbound and inbound filtering rules, monitor DNS queries for the domain, and watch for any related URLs that share the same Webflow subdomain pattern. Continuous re‑scanning on VirusTotal and periodic checks against emerging blocklists are advised to capture any escalation in detection counts. Organizations should also educate users about the risk of unsolicited links that may resolve to newly created Webflow sites, as the platform’s ease of deployment can be abused for short‑lived phishing pages.