elitebookings[.]pro

elitebookings.pro was registered through NameCheap on 19 April 2025. The domain resolves to 66.33.60.193, an address owned by Amazon.com, Inc. (AS16509) located in the United States. DNS records show a single authoritative name server and MX entries pointing to Zoho mail services (mx.zoho.com priority 10, mx2.zoho.com priority 20). The web server presents a TLS certificate issued by Let’s Encrypt (R12) and enforces HSTS, indicating an attempt to appear legitimate. HTTP requests receive a 302 redirect, and the page title reported by the scanner reads “CelebBooking – Celebrity Booking Platform”, suggesting the site is masquerading as a booking service for public figures.

Threat intelligence platforms have recorded the domain on one security blocklist and PhishDestroy actively blocks it. VirusTotal analysis shows a single positive detection out of ninety‑five scanners, confirming at least one vendor identified malicious behavior. The underlying infrastructure is hosted on Vercel, a common SaaS platform for rapid deployment, which aligns with the observed technology fingerprint of Vercel and Zoho. No additional public intelligence such as OTX or Safe Browsing entries is currently available. Given the combination of a recent registration, a redirecting web server, a brand‑specific page title, and the presence on a phishing blocklist, the domain should be treated as a high‑risk phishing vector.

Defenders should add the domain and its resolved IP address to inbound and outbound filtering rules, monitor DNS queries for the associated MX hosts, and ensure that any user‑facing applications block content from the URL. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any evolution in payload delivery. Incident response teams should also verify if any credential‑phishing emails reference the “CelebBooking” brand and correlate those with internal logs.