verifyguest31125-booking[.]com

Analysis of verifyguest31125-booking.com indicates an active credential-phishing operation launched on 12 June 2026. The domain is registered through Hello Internet Corp and uses the WebNIC name servers ns100.webnic.cc and ns101.webnic.cc. PhishDestroy has already blocked the site, and it appears on one external security blocklist. VirusTotal scans show that 13 of 91 antivirus and URL-reputation engines flag the domain as malicious, confirming a consensus of detection across multiple vendors.

The elevated risk rating aligns with the observed detection volume and the fact that the domain is currently active. Infrastructure details beyond the registrar and name-server information are not publicly disclosed; no IP address, autonomous system number, or hosting provider data are available in the current intelligence set. Likewise, SSL/TLS configuration, HTTP response codes, page title, and Safe Browsing status have not been published, limiting the ability to assess transport-layer security or content-based indicators. The lack of additional context means that defenders should treat the domain as untrusted until further forensic evidence is obtained.

Defensive recommendations include adding verifyguest31125-booking.com to outbound and inbound web filtering rules, ensuring that email gateways block any messages containing URLs to this domain, and sharing the indicator with threat-intel sharing platforms. Continuous monitoring of the domain’s resolution and any new detections from reputation services is advised, as changes in hosting or certificate deployment could alter its threat profile. Organizations should also educate users about credential-phishing attempts that may reference "booking" terminology, reinforcing the need to verify URLs before entering credentials.