cardverify17545-booking[.]com

This domain, cardverify17545-booking.com, is flagged as an active credential phishing site designed to harvest user login credentials under the guise of a booking verification process. Analysis indicates the domain impersonates legitimate booking or payment verification services, likely targeting users of travel or e-commerce platforms. No specific drainer kit signatures were identified in available telemetry, but the domain exhibits characteristics consistent with credential theft campaigns, including the use of Cloudflare for obfuscation and rapid deployment tactics. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious activity. It resolves to the IP address 188.114.96.3 and is detected by 16 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. Technologies detected include Cloudflare Browser Insights and HTTP/3, which are often leveraged to evade detection and enhance phishing page performance. No Google Safe Browsing (GSB) listing was observed in the latest data, though this may reflect a lag in propagation. Current status remains active, with the domain continuing to resolve and serve phishing content. Response actions should include immediate blocking of the domain and its associated IP (188.114.96.3) at the network perimeter, as well as monitoring for internal connections to this infrastructure. The risk level is classified as elevated due to the domain's recent registration, use of evasion techniques, and confirmation by multiple security vendors. Organizations are advised to review logs for outbound connections to this domain or IP and conduct user awareness training to mitigate credential theft risks. Indicators of compromise (IOCs) should be disseminated to threat intelligence platforms to support broader detection efforts.