bwh-hotelgroup-reservation6383012[.]com

This domain, bwh-hotelgroup-reservation6383012.com, is identified as a high-risk phishing site targeting users of the Booking.com platform. The page title, 'Booking.com | Official website | Best hotels and accommodation,' directly mimics the legitimate brand to deceive victims into submitting personal and payment details. No drainer kit signatures were observed, but the infrastructure aligns with credential-harvesting campaigns commonly deployed against travel and hospitality sectors. Infrastructure analysis reveals the domain was registered on November 09, 2025, through Dynadot LLC and currently resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Security vendors flagged the domain in 17 out of 95 scans on VirusTotal, while Google Safe Browsing classifies it as phishing. The domain appears on two security blocklists, and no SSL certificate was detected, further indicating malicious intent. The absence of encryption and use of a recently registered domain are consistent with short-lived phishing operations. The domain has since been taken offline, likely due to automated takedown mechanisms or registrar intervention. However, residual risk remains as threat actors may re-deploy the same infrastructure under a new domain or IP. Users who interacted with the site should monitor for unauthorized transactions and reset credentials for any linked accounts. Organizations are advised to block the domain and IP at the network level and alert employees to the phishing campaign targeting Booking.com branding.