guestverify12411-booking[.]com

The domain guestverify12411-booking.com has been identified as a credential phishing site specifically designed to impersonate Booking.com, a widely recognized online travel agency. This infrastructure was actively harvesting user login credentials by presenting a fraudulent authentication portal mimicking the legitimate Booking.com interface. As of the latest verification, the domain has been taken offline, though prior activity remains a confirmed threat. Analysis indicates the domain was flagged by 14 of 95 security vendors on VirusTotal, demonstrating moderate to high detection rates across multiple threat intelligence platforms. Registered on June 16, 2025, through Hello Internet Corp, the domain appeared on two independent security blocklists and was included in six threat intelligence pulses on a major open-source threat exchange platform. Infrastructure analysis reveals the domain was operational for a limited period but achieved sufficient visibility to warrant widespread blocking by enterprise and consumer security filters. Current status confirms the domain is offline, though residual risk persists due to potential credential reuse by threat actors. Organizations and individuals are advised to revoke any credentials entered on this domain, enable multi-factor authentication on all travel-related accounts, and monitor for unauthorized booking activity or account modifications. Network administrators should ensure endpoint protection systems are updated to recognize this domain and its associated indicators of compromise, including any linked IP addresses or SSL certificates. Proactive credential rotation is recommended for users who may have interacted with the site prior to its takedown.