Dodgy Booking complaint email doing the rounds

You may receive an email with a blank subject line and a sender tied to booking-partner.com, dressed up as a Booking.com Partner Notification. It claims a guest has complained about bed bugs and tells you to click through to view photo and video evidence. If you manage accommodation, it is designed to look urgent enough that you act before you think.

What gives it away is that the message does not stand up to basic trust checks. Your email system could not properly confirm it really came from who it claimed to be, and the sender domain is newly registered, which means it has little to no established history as a legitimate business sender. That combination is a strong sign you are looking at impersonation, not a genuine partner communication.

The attacker is trying to get you to click, hand over credentials, or engage with a fake workflow that opens the door to account takeover. If you follow the link and sign in, you could give away access to business email, booking systems, or other connected accounts. That can quickly turn into fraud, data exposure, and further phishing sent from your own organisation.

This campaign has been seen across more than one environment, which means you should assume other NZ businesses could be seeing the same lure. It keeps appearing because the branding is familiar, the complaint theme creates urgency, and newly created domains can be spun up quickly for short phishing runs.