confirmation01249-booking[.]com

This domain, confirmation01249-booking.com, is actively flagged as a high-risk banking phishing site. Registered on September 26, 2025, through Atak Domain, the domain remains operational as of July 12, 2026, despite being blocked by multiple security sources, including PhishDestroy and PhishingDB. Analysis indicates the domain is hosted on Cloudflare infrastructure, resolving to IP address 104.21.54.30 (AS13335, United States). The nameservers, candy.ns.cloudflare.com and woz.ns.cloudflare.com, further confirm Cloudflare as the hosting provider, a common choice for threat actors due to its privacy and resilience features. The domain is detected by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it under SOCIAL_ENGINEERING. AlienVault OTX records show the domain appearing in 19 threat intelligence pulses, suggesting widespread recognition of its malicious nature. The HTTP status code 521, often associated with Cloudflare-protected sites experiencing backend issues, does not diminish the domain's active threat status. The page title, 'AD not found (captcha2),' provides limited insight into the exact content but aligns with techniques used to evade automated detection or confuse users. Infrastructure analysis reveals the use of HTTP/3 and a SSL certificate issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the domain's malicious intent. The domain appears on two security blocklists, reinforcing its classification as a banking phishing threat. Defenders should treat this domain as active and high-risk, prioritizing blocking at the DNS and network levels. Given the lack of detailed content analysis, further investigation into associated URLs or payloads is recommended to determine the full scope of the phishing campaign. No specific financial institution is named in the available data, but the scam type is explicitly identified as banking phishing.