confirmation009-booking[.]com

Analysis indicates confirmation009-booking.com was registered on 24 September 2025 through Atak Domain Bilgi Teknolojileri A.S. The domain resolves to 104.21.10.190, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The TLS certificate presented is identified as WE1, which provides no additional validation of the operator. Automated scanning on VirusTotal recorded 14 positive detections out of 95 participating engines, reflecting a consensus that the site is malicious. The domain is listed on a single public security blocklist and has been captured in one AlienVault Open Threat Exchange pulse, indicating that threat‑sharing communities have observed activity associated with it. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the host.

The documented scam type is Banking Phishing, and the site has been flagged by the PhishDestroy sinkhole as a phishing source. Current network measurements show the domain is taken offline, so active content is not reachable at the time of this report. Nevertheless, the infrastructure—particularly the Cloudflare edge IP—remains reusable for future campaigns, and the registrar information suggests a low‑cost registration pathway that can be leveraged repeatedly.

Defenders should add confirmation009-booking.com to URL filtering and DNS block lists, enforce outbound traffic controls to the IP 104.21.10.190, and monitor for any re‑appearance of the domain or similar registrations from the same registrar. Correlating logs for TLS handshake attempts using the WE1 certificate can help identify residual malicious traffic. Continuous ingestion of threat‑intel feeds that reference the associated AlienVault pulse and the PhishDestroy blocklist will aid in rapid detection of re‑hosted variants.