booking-com-cf2[.]prope347383[.]homes

This domain is flagged as a high-risk credential harvesting phishing site targeting users through impersonation of legitimate booking platforms. Analysis indicates the infrastructure is designed to deceive victims into submitting login credentials, payment details, or personal information under false pretenses. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of subdomain obfuscation and brand impersonation tactics. Infrastructure analysis reveals the domain booking-com-cf2.prope347383.homes was registered on February 10, 2026, through NameSilo, LLC, a registrar frequently observed in phishing operations. It currently resolves to IP address 172.67.179.188, which is associated with a content delivery network known to host malicious domains. VirusTotal reports 1 out of 95 security vendors have detected this domain as malicious, suggesting low initial detection rates but confirmed phishing behavior. No entries were found on major blocklists, and trust scores from reputation services indicate minimal prior scrutiny, likely due to its recent creation and low traffic volume. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP at the perimeter firewall or DNS level to prevent access. Security teams are advised to monitor logs for connections to 172.67.179.188 or subdomains matching the pattern booking-com-cf*.prope*.homes. End users should be educated to verify URLs before entering credentials, particularly on pages requesting sensitive information. If credentials were entered on this domain, affected accounts must be locked, passwords reset, and multi-factor authentication enforced. Incident responders should preserve HTTP headers, screenshots, and timestamps for forensic analysis and potential takedown coordination.