booking[.]com[.]4nm[.]prop3542[.]homes

This domain poses an elevated risk as a brand impersonation threat, specifically targeting users of Booking.com to steal login credentials and financial information. The domain booking.com.4nm.prop3542.homes leverages a deceptive subdomain structure to appear legitimate, but it is a sophisticated phishing site designed to harvest sensitive data from unsuspecting victims.

Technical indicators confirm the malicious nature of this domain. VirusTotal analysis shows 13 out of 95 security vendors flagging it as malicious, marking a clear consensus among multiple threat intelligence sources. The domain was registered on June 6, 2025, through NameSilo, LLC, and resolves to IP address 107.175.222.187. It currently lacks an SSL certificate, a common red flag for phishing sites. The domain has been taken offline but still appears on 2 security blocklists, indicating ongoing risk if the domain or similar infrastructure resurfaces. The page title, "Departamento en Renta Las Residencias Valle Poniente 1, Huasteca Real Santa Catarina Nuevo León - 2024 Great Prices," attempts to mimic a legitimate rental listing while the subdomain tricks users into thinking they are on Booking.com.

To mitigate this threat, users should avoid clicking any links from emails or messages that direct to unfamiliar subdomains of known brands. Always verify the full URL before entering credentials, and ensure the site has a valid SSL certificate. Organizations should block the domain and IP 107.175.222.187 at the network level, and monitor for similar phishing attempts using brand impersonation techniques. PhishDestroy recommends reporting any sightings to relevant security teams and educating users about verifying URLs, especially those with multiple subdomains or unusual top-level domains like .homes.