verifyguest4415-booking[.]com

Analysis of verifyguest4415-booking.com indicates active credential‑phishing infrastructure. The domain was registered on 12 June 2026 through Hello Internet Corp and uses the Webnic nameservers ns100.webnic.cc and ns101.webnic.cc. DNS resolution points to the single IPv4 address 216.120.147.200, which is the only known hosting endpoint. The domain appears on one public security blocklist and has been tagged by the PhishDestroy mitigation service.

VirusTotal scans show that 11 of 91 antivirus and URL‑reputation engines returned a malicious verdict, reinforcing the phishing classification. No additional public threat‑intel such as OTX tags, Safe Browsing observations, SSL certificate details, HTTP status codes, or page title are currently disclosed, leaving the broader attack surface undefined. The limited evidence suggests a short‑lived, credential‑harvesting campaign likely targeting users of booking‑related services, but the exact lure or credential collection method cannot be confirmed without further page analysis. Defenders should block DNS resolution to 216.120.147.200, add the domain to web‑filter deny lists, and monitor outbound traffic for connections to the IP.

Network intrusion detection signatures that flag HTTP requests containing the domain name or its IP should be deployed. Email gateway rules that flag messages containing the domain or similar sub‑domains are recommended, and user education about unsolicited booking‑related credential requests should be reinforced. Continuous re‑evaluation is advised as additional detections may appear in future VirusTotal or blocklist updates.