confirmation63-booking[.]com

confirmation63-booking.com was registered on 7 November 2025 through Dominet (HK) Limited. The domain resolves to the Cloudflare address 172.67.159.70, which is associated with AS13335 in the United States. Nameservers listed are fattouche.ns.cloudflare.com and kristin.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate is present, and the site is currently taken offline, returning no HTTP response. Public intelligence flags the domain as a banking‑phishing campaign targeting users of the travel booking brand referenced in the page title “Booking.com | Official website | Best hotels and accommodation.” The page title was captured before the takedown and matches the legitimate brand, suggesting a credential‑harvesting attempt.

The domain appears on one security blocklist and has been blocked by PhishDestroy. Google Safe Browsing classifies it under social engineering, and AlienVault OTX reports inclusion in two threat‑intelligence pulses. VirusTotal recorded 16 positive detections out of 95 scanning engines, reinforcing the malicious assessment. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. These scores, together with the observed detections, confirm a high‑risk profile.

Because the domain employs Cloudflare’s infrastructure, attribution to a specific operator is obscured, but the combination of registrar, recent creation date, and lack of SSL suggests a disposable phishing setup. Defenders should add the domain and its resolving IP to block lists, monitor for any re‑registration, and enforce email filtering rules that detect the brand‑related subject lines associated with this campaign. Continuous observation of Cloudflare‑owned IP ranges for anomalous traffic may help identify additional phishing sites that share the same infrastructure.