12487guest-booking[.]com

This domain, 12487guest-booking.com, is identified as a credential phishing site specifically targeting hotel and guest booking platforms. Analysis indicates the infrastructure was designed to harvest login credentials from hospitality sector employees and customers. The domain is currently offline, though prior activity suggests it may have impersonated legitimate booking services to deceive victims. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Hello Internet Corp, a registrar frequently associated with high-risk domains. Security telemetry shows the domain was flagged by 12 of 95 vendors on VirusTotal, with additional detections across six threat intelligence pulses in AlienVault OTX. The domain appears on two security blocklists and is actively blocked by multiple reputation-based filtering systems. No associated IP addresses were publicly attributed at the time of analysis, though historical DNS records may reveal prior hosting patterns. The domain has been taken offline, likely due to enforcement actions or infrastructure changes by the threat actor. Organizations are advised to review logs for connections to 12487guest-booking.com between June and August 2026 and reset any credentials potentially exposed during that period. Security teams should monitor for similar domains registered through Hello Internet Corp or using the same naming convention, as threat actors frequently reuse registrar and naming patterns across campaigns.