cardverify1205-booking[.]com

This domain, cardverify1205-booking.com, operates as an active credential theft site designed to harvest user login credentials through deceptive booking platform impersonation. Analysis indicates the infrastructure mimics legitimate travel or reservation services, presenting fraudulent login portals to trick victims into submitting sensitive account details. The campaign appears tailored to exploit users seeking travel-related services, with a focus on capturing credentials for subsequent unauthorized access or financial fraud. Evidence supporting this assessment includes detection by 15 out of 95 security engines on VirusTotal, alongside presence on two security blocklists. The domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious domains. Infrastructure analysis reveals resolution to IP address 188.114.96.3, with Cloudflare services employed to obfuscate backend infrastructure. Additionally, the domain appears in six threat intelligence pulses, further corroborating its malicious intent. Users who have interacted with cardverify1205-booking.com should immediately revoke any entered credentials, particularly for accounts tied to travel or financial services. It is recommended to scan affected devices for malware or unauthorized access, as credential theft sites often deploy secondary payloads. Monitoring for unusual account activity, such as unauthorized logins or transactions, is critical. Organizations should update security policies to block this domain and its associated IP address to prevent further exposure.