r4[.]gobookroom[.]com

This domain, r4.gobookroom.com, presents an elevated-risk brand impersonation threat targeting Airbnb users. Analysis indicates the domain was configured to mimic legitimate Airbnb booking pages, as evidenced by its page title ('Airbnb') and registration details. The intent appears to be credential harvesting or financial fraud, leveraging the trust associated with the Airbnb brand to deceive users into entering sensitive information such as login credentials, payment details, or personal data on fraudulent forms. Infrastructure analysis reveals the domain was registered on October 26, 2025, through GoDaddy.com, LLC, and resolves to the IP address 8.208.91.126, hosted on Alibaba (US) Technology Co., Ltd. infrastructure (AS45102). The domain is flagged by 17 out of 95 security vendors on VirusTotal, appears on one security blocklist, and lacks an SSL certificate, increasing its detectability as malicious. The domain is currently offline, but its prior activity and registration details suggest it was operational long enough to pose a credible threat. Users who visited r4.gobookroom.com should take immediate action to mitigate potential compromise. If any credentials or payment information were entered, reset passwords for Airbnb and associated accounts, enable multi-factor authentication, and monitor financial statements for unauthorized transactions. Additionally, scan the device used to access the domain for malware, as impersonation sites may deploy malicious payloads. Report the incident to the targeted brand’s security team and relevant authorities to aid in takedown efforts and prevent further exploitation.