confirmation0292-booking[.]com

The domain confirmation0292-booking.com has been identified as a credential theft operation targeting users of travel and booking platforms. Analysis indicates the infrastructure is designed to impersonate legitimate travel services, presenting fraudulent login or verification pages to harvest user credentials and payment information. The domain is currently offline, but prior activity suggests a focus on exploiting trust in well-known booking brands through deceptive URLs and cloned interfaces. Infrastructure analysis reveals the domain was registered on October 02, 2025, through Atak Domain and resolves to the IP address 104.21.53.227, hosted on Cloudflare's network (AS13335). Security vendors flagged the domain in 19 of 95 VirusTotal scans, while Google Safe Browsing and two additional blocklists classify it as malicious. The SSL certificate, issued by Google Trust Services (WE1), was likely used to lend false legitimacy to the fraudulent pages. The page title 'AD not found (captcha2)' suggests the use of cloaking techniques or placeholder content to evade detection during automated scans. The domain's current offline status does not eliminate the risk of future reactivation or similar campaigns. Organizations and users are advised to block the domain and its associated IP at the network level, monitor for related subdomains or typosquatting variants, and implement multi-factor authentication (MFA) to mitigate credential theft risks. Security teams should review logs for connections to 104.21.53.227 or domains registered via Atak Domain, particularly those created in early October 2025. End users should verify the authenticity of travel booking emails or links by cross-referencing with official brand domains and avoiding unsolicited verification requests.