booking-com-dcfd[.]onrender[.]com

Analysis as of August 07, 2026 indicates that the domain booking-com-dcfd.onrender.com is actively used in a generic phishing campaign and is classified with an elevated risk level. The domain is listed on two public security blocklists and has been explicitly blocked by the PhishDestroy and OpenPhish feed providers, confirming its reputation as malicious. DNS resolution points to the IP address 216.24.57.7, which is the sole A‑record observed for the domain; no additional records have been identified.

VirusTotal reports that 17 of 91 security vendors flag the domain, demonstrating a moderate level of consensus among scanners that the site hosts malicious content. The available intelligence does not include registrar information, SSL certificate details, HTTP response codes, page title, or any observed content from the site, leaving those aspects unverified. Consequently, defenders cannot assess whether the site employs HTTPS or what specific lure is presented to victims, but the existing detections are sufficient to treat the domain as hostile.

Recommended mitigation steps include adding booking-com-dcfd.onrender.com to DNS‑based deny lists, configuring web proxies to block HTTP(S) requests to the resolved IP 216.24.57.7, and monitoring outbound traffic for connections to that address. Organizations should also alert users about the possibility of phishing emails that reference the domain, especially those appearing to originate from booking.com or related travel services. Continuous re‑evaluation is advised, as further infrastructure such as additional C2 hosts or credential‑stealing pages may be deployed without notice.