confirmation01248-booking[.]com

This domain is assessed as high risk and classified under generic_phishing, indicating a credential harvesting operation designed to impersonate booking-related services and capture user authentication data through deceptive CAPTCHA gating mechanisms. Analysis indicates the infrastructure is consistent with phishing landing pages that attempt to bypass automated detection while presenting a false verification flow.

Technical intelligence confirms multiple corroborating indicators: VirusTotal reports 17/95 security vendors flag the domain as malicious. The domain is registered through Atak Domain. It resolves to IP address 188.114.97.3, hosted within US-based infrastructure under AS13335 (Cloudflare, Inc.). The domain creation date is October 01 2025. It appears on 2 security blocklists, specifically PhishDestroy and PhishingDB. Google Safe Browsing explicitly flags the domain as phishing. SSL termination is observed via Google Trust Services / WE1 certificate. The observed page title is "AD not found (captcha2)". Current operational status is offline, suggesting active takedown or sinkholing.

Mitigation analysis indicates that any exposure to this domain should be treated as a potential credential compromise attempt. Users should avoid entering any login, payment, or personal data if the domain reappears in active infrastructure. Network defenders should block resolution at DNS and HTTP layers, monitor for outbound requests to 188.114.97.3, and correlate logs for any POST submissions to CAPTCHA-like endpoints. Threat hunting should prioritize detection of similar domains using booking-themed naming patterns combined with numeric prefixes and CAPTCHA gating pages. Incident response teams should also review authentication logs for anomalous login attempts potentially originating from this phishing campaign and enforce credential resets where exposure is suspected.