7pysv[.]gobookroom[.]com

7pysv.gobookroom.com was registered through GoDaddy.com, LLC on 26 October 2025. The domain resolves to the IPv4 address 8.208.91.126, which maps to a host located in Great Britain and is announced by AS45102 belonging to Alibaba (US) Technology Co., Ltd. Nameserver records point to money.dnspod.net and pollux.dnspod.net. No TLS certificate was observed for the host, indicating that any web service would be delivered over plain HTTP. The page title returned by the server is “Airbnb”, matching the declared brand target of Airbnb and the classification of an e‑commerce impersonation. Reputation services assign extremely low trust scores: Gridinsoft reports 0 / 100, and Scamadviser reports 1 / 100.

VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. The overall risk level is listed as elevated, and the current operational status is offline. Analysis indicates that the infrastructure components—GoDaddy registration, DNSPod nameservers, and Alibaba‑hosted IP—are consistent with known phishing‑hosting patterns. The absence of a TLS certificate reduces the credibility of the site but does not preclude credential harvesting.

The low trust scores and multiple vendor detections corroborate the malicious intent. Uncertainty remains regarding the exact payload or credential collection mechanism, as no page content has been captured. Defenders should continue to block the resolved IP address and the associated ASN, add the domain to internal deny lists, and monitor for newly created sub‑domains under gobookroom.com that use the same nameservers. Threat intelligence feeds should be updated with the registration details and detection counts to improve early warning for similar e‑commerce impersonation campaigns targeting Airbnb users.