guestverify768411-booking[.]com

This domain, guestverify768411-booking.com, was engineered to harvest login credentials by mimicking Booking.com verification pages. Victims were likely lured through deceptive emails or messages claiming account verification requirements, leading to a fraudulent input form designed to capture usernames, passwords, and potentially payment details. The site specifically targeted travelers and hotel booking users, exploiting trust in the Booking.com brand to facilitate unauthorized access to accounts. Analysis indicates the domain was registered on June 16, 2025, through Hello Internet Corp, a registrar frequently associated with high-risk domains. Security vendors on VirusTotal flagged the domain at a rate of 14 out of 95, reflecting moderate consensus on its malicious nature. Additionally, the domain appeared in six threat intelligence pulses on AlienVault OTX and was listed on two security blocklists, further corroborating its role in credential theft operations. Infrastructure analysis reveals the site was taken offline shortly after detection, though residual risks remain for users who engaged with it prior to deactivation. Users who visited guestverify768411-booking.com or entered credentials on the site should assume their login details were compromised. Immediately change passwords for Booking.com and any other accounts where the same credentials were reused. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized bookings or payment attempts. If financial information was entered, contact the relevant institution to report potential fraud and consider placing a fraud alert on credit files. Report the incident to local cybersecurity authorities or dedicated fraud reporting platforms to aid in tracking and mitigating further threats.