booking-jp[.]com

This domain, booking-jp.com, is flagged as a high-risk credential theft phishing site targeting users through brand impersonation. Analysis indicates the infrastructure is designed to harvest login credentials, payment details, or personal data under the guise of legitimate travel services. The threat type is narrowly classified as credential theft, with no evidence of crypto drainer or malware distribution mechanisms at this time. Infrastructure analysis reveals the domain was registered on February 26, 2026, through GoDaddy.com, LLC, a registrar frequently abused for malicious campaigns. It resolves to the IP address 121.127.232.46, hosted under AS152194 (CTG Server Limited) in Hong Kong, a network segment with a history of hosting phishing and fraudulent domains. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for threat actors due to its low-cost and automated issuance process. Detection metrics show the domain is currently flagged by 16 out of 95 security vendors on VirusTotal, with one additional blocklist (PhishDestroy) confirming its malicious status. The domain remains active, indicating ongoing operational use. Mitigation against credential theft phishing requires immediate action from both end users and network administrators. Users should avoid interacting with the domain, particularly entering login credentials or financial information. Browser-based warnings or enterprise security tools should be configured to block access to the domain and its associated IP. Network defenders are advised to monitor for connections to 121.127.232.46 and implement DNS-based blocking for booking-jp.com. Organizations impersonated by this domain should issue public advisories to their user base, emphasizing the use of official channels only. Given the domain's recent creation date and active status, continuous monitoring for related infrastructure is recommended.