cardverify56535-booking[.]com

The domain cardverify56535-booking.com was registered on June 12, 2026 through Atak Domain Bilgi Teknolojileri A.S. and is presently active. Within a short period of its creation, the domain has been added to a security blocklist and is blocked by the PhishDestroy service, indicating that threat‑intel feeds have identified it as malicious.

VirusTotal analysis shows that 12 out of 91 security vendors have flagged the domain, a detection rate that reinforces the suspicion of credential‑phishing activity. The elevated risk rating assigned to the domain reflects the combination of its recent registration, blocklist presence, and multi‑vendor detections. No additional technical artifacts such as IP address, hosting provider, SSL certificate details, HTTP response codes, or page title have been disclosed, leaving those aspects of the infrastructure unverified at this time.

Defenders should treat the domain as hostile and incorporate it into URL filtering, DNS sink‑hole, and endpoint protection policies. Continuous monitoring of related DNS queries and any traffic to the domain is advised, as well as updating internal blocklists to include the domain and any observed subdomains. Given the early stage of the campaign, threat‑hunting teams should also look for credential‑theft attempts that reference the domain or its associated brand keywords in logs, and consider sharing any new indicators of compromise with broader intelligence communities to accelerate detection and mitigation efforts.