booking-bd[.]com

This domain, booking-bd.com, is identified as an active credential harvesting phishing site designed to deceive users into submitting login credentials, payment details, or other sensitive information. Analysis indicates the domain mimics legitimate booking platforms, a common tactic in phishing campaigns targeting travelers, hospitality services, and e-commerce users. The infrastructure is configured to exploit trust in well-known brands, potentially leading to account takeovers, financial fraud, or identity theft if users interact with the site. Evidence supporting this assessment includes detection by 13 out of 95 security vendors on VirusTotal, a creation date of March 17, 2025, and registration through Name.com, Inc. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. It resolves to the IP address 104.21.64.1, hosted under AS13335 (Cloudflare, Inc.), a provider frequently leveraged by malicious actors to obfuscate origin servers and evade takedowns. The SSL certificate, issued by Cloudflare TLS Issuing ECC CA 3, further suggests the use of content delivery network services to mask the true hosting infrastructure. Users who have visited booking-bd.com or entered credentials on the site should immediately revoke any submitted information, change passwords for associated accounts, and monitor for unauthorized activity. Network administrators are advised to block the domain and its resolving IP (104.21.64.1) at the perimeter to prevent further exposure. Given the elevated risk level, organizations should review logs for connections to this domain and assess potential compromise of sensitive data. If financial details were entered, affected parties should contact their financial institutions to secure accounts and report the incident to relevant cybersecurity authorities.