booking[.]page750651[.]cfd

This report details the investigation of the domain booking.page750651.cfd, which has been identified as a banking phishing site with an elevated risk level. The domain was registered through OwnRegistrar, Inc. on October 22, 2025, and is currently offline. Infrastructure analysis reveals that the domain resolves to the IP address 104.21.79.251, located in the United States and associated with AS13335 Cloudflare, Inc. The nameservers used are lina.ns.cloudflare.com and sevki.ns.cloudflare.com, indicating the use of Cloudflare's DNS services. The domain appears on one security blocklist, specifically PhishDestroy, which has flagged it for blocking.

Analysis from Gridinsoft and Scamadviser provides trust scores of 0/100 and 1/100, respectively, indicating a very low level of trust and high likelihood of malicious activity. The domain has been flagged by 16 of 95 security vendors, suggesting a moderate level of recognition among threat detection systems. Despite the domain being offline, the historical data and trust scores suggest that it has been or may still be used for phishing attacks targeting banking credentials. Defenders should remain vigilant and ensure that this domain is blocked in their network security configurations.

Additionally, users should be informed to avoid any links or communications that lead to this domain, as it poses a significant risk to financial security. The exact content and layout of the phishing site have not been analyzed, but the classification as a banking phishing site indicates that it may have been designed to trick users into providing sensitive financial information. Further monitoring and analysis are recommended to track any potential reactivation of this domain.