booking[.]confirmation-id-87596[.]com

Analysis of booking.confirmation-id-87596.com shows a newly registered domain (creation date February 21 2026) that has been associated with a banking‑phishing campaign. The site employed an SSL certificate identified as WE1, indicating that HTTPS was available before the domain was taken offline. Infrastructure data places the domain on a single security blocklist and confirms resolution to IP 172.67.155.102, which belongs to AS13335 Cloudflare, Inc. in the United States.

Reputation checks are extremely poor: Gridinsoft assigns a score of 0 out of 100 and Scamadviser rates the domain at 1 out of 100. VirusTotal records indicate that 21 of 93 scanned security vendors flagged the domain as malicious, reinforcing the phishing classification. The domain is presently offline and has been blocked by the PhishDestroy service, suggesting that active hosting has been stopped but the underlying infrastructure (Cloudflare IP) remains reusable for future attacks.

Defenders should immediately add the fully qualified domain name to local and network‑wide blocklists, enforce DNS filtering on the associated IP address, and monitor the Cloudflare‑owned address range for any re‑use of the same host. Continuous re‑evaluation of the SSL certificate and any re‑appearance of the domain on additional blocklists is advised, as threat actors often resurrect dormant domains after a brief takedown period.