r2[.]gobookroom[.]com

This domain, r2.gobookroom.com, is identified as a brand impersonation threat targeting Airbnb users. Analysis indicates the site mimics Airbnb’s official branding, as evidenced by the page title "Airbnb," to deceive victims into submitting sensitive credentials. No crypto drainer kit or secondary payload delivery was observed in initial scans, though credential theft remains the primary objective. The infrastructure lacks SSL encryption, increasing the likelihood of interception during data transmission. Infrastructure analysis reveals the domain was registered on October 26, 2025, through GoDaddy.com, LLC. It resolves to the IP address 8.208.91.126, hosted on infrastructure belonging to AS45102 (Alibaba (US) Technology Co., Ltd.) in Great Britain. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. The absence of an SSL certificate further degrades its legitimacy, aligning with common tactics used in low-to-moderate sophistication phishing campaigns. The domain has been taken offline, likely due to detection and reporting by security vendors. However, residual risk persists as threat actors may re-deploy the infrastructure under a new domain or IP address. Users who interacted with the site should assume credential exposure and initiate password resets for Airbnb and any reused credentials. Organizations are advised to monitor for similar domains using the "gobookroom" naming pattern or Alibaba-hosted IPs in their logs. Proactive blocking of the IP 8.208.91.126 and domains registered via GoDaddy with recent creation dates may mitigate future threats from this actor.