{
  "name": "Thousands of Fake Hotel Domains Used in Massive Phishing Campaign",
  "slug": "thousands-of-fake-hotel-domains-used-in-massive-phishing-campaign",
  "description": "A Russian-speaking threat actor has orchestrated a large-scale phishing campaign targeting travelers by registering over 4,300 domain names since early 2025. The sophisticated operation impersonates major travel brands like Airbnb and Booking.com to steal payment card data. The phishing sites use customized pages based on unique URL strings, fake CAPTCHA systems, and multilingual translations to appear legitimate. The campaign employs malicious emails with links that redirect through multiple sites before reaching the phishing page. The attacker consistently registers new domains, focusing on specific registrars and using naming conventions that incorporate travel-related terms and hotel names. The phishing kit includes real-time data collection and Russian language elements in the source code.",
  "published": "2025-11-11T17:26:17+00:00",
  "created_at": "2025-11-11T17:26:17+00:00",
  "modified_at": "2025-11-12T01:40:46+00:00",
  "created_at_opencti": "2025-11-11T17:26:17+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-11-11",
    "domain registration",
    "malspam",
    "phishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "testing.diogoflix.com"
      },
      {
        "id": "",
        "name": "test.diogoflix.com"
      },
      {
        "id": "",
        "name": "support.diogoflix.com"
      },
      {
        "id": "",
        "name": "static.diogoflix.com"
      },
      {
        "id": "",
        "name": "staging.diogoflix.com"
      },
      {
        "id": "",
        "name": "m.diogoflix.com"
      },
      {
        "id": "",
        "name": "docs.diogoflix.com"
      },
      {
        "id": "",
        "name": "dev.diogoflix.com"
      },
      {
        "id": "",
        "name": "demo.diogoflix.com"
      },
      {
        "id": "",
        "name": "csa.diogoflix.com"
      },
      {
        "id": "",
        "name": "citi-cardverify.serveftp.com"
      },
      {
        "id": "",
        "name": "cdn.diogoflix.com"
      },
      {
        "id": "",
        "name": "assets.diogoflix.com"
      },
      {
        "id": "",
        "name": "apps.diogoflix.com"
      },
      {
        "id": "",
        "name": "alfabank.cardverify78004-booking.com"
      },
      {
        "id": "",
        "name": "alfabank.cardverify2710-booking.com"
      },
      {
        "id": "",
        "name": "zuveqtra.com"
      },
      {
        "id": "",
        "name": "zurkrone-guest5325.cfd"
      },
      {
        "id": "",
        "name": "zooomasssist.es"
      },
      {
        "id": "",
        "name": "zoneform832.com"
      },
      {
        "id": "",
        "name": "zoneform312.com"
      },
      {
        "id": "",
        "name": "zoandl-ikeytr-bzakl.com"
      },
      {
        "id": "",
        "name": "zirt-evnmb-ddfq.icu"
      },
      {
        "id": "",
        "name": "ziggylinks.com"
      },
      {
        "id": "",
        "name": "zenitorizon.com"
      },
      {
        "id": "",
        "name": "zenithwin661.info"
      },
      {
        "id": "",
        "name": "zenithotel.world"
      },
      {
        "id": "",
        "name": "zedwellpiccadillycircus2025.com"
      },
      {
        "id": "",
        "name": "zedwellundergroundhoteltottenhamcourtrd.com"
      },
      {
        "id": "",
        "name": "zemorith.com"
      },
      {
        "id": "",
        "name": "zedwellpiccadillycircus.world"
      },
      {
        "id": "",
        "name": "zedwellgreenwich.world"
      },
      {
        "id": "",
        "name": "zaoljqwer-csf.world"
      },
      {
        "id": "",
        "name": "zandvoortgutar.com"
      },
      {
        "id": "",
        "name": "zalm37.be"
      },
      {
        "id": "",
        "name": "zaanhotel.world"
      },
      {
        "id": "",
        "name": "you5790.com"
      },
      {
        "id": "",
        "name": "you444.com"
      },
      {
        "id": "",
        "name": "yollofullo.com"
      },
      {
        "id": "",
        "name": "yaopeng.icu"
      },
      {
        "id": "",
        "name": "yalourbangent.world"
      },
      {
        "id": "",
        "name": "yallofullo.com"
      },
      {
        "id": "",
        "name": "yadojapan.com"
      },
      {
        "id": "",
        "name": "xvwt.com"
      },
      {
        "id": "",
        "name": "xendrias.com"
      },
      {
        "id": "",
        "name": "xhtef-clqui-sebs.click"
      },
      {
        "id": "",
        "name": "xandoril.com"
      },
      {
        "id": "",
        "name": "wyndham-sao-paulo-ibirapuera.com"
      },
      {
        "id": "",
        "name": "wwebsolympialocasly.com"
      },
      {
        "id": "",
        "name": "wubook-reserve.com"
      },
      {
        "id": "",
        "name": "worldawaitsgo.com"
      },
      {
        "id": "",
        "name": "world-resorts.net"
      },
      {
        "id": "",
        "name": "woonlergyplay.com"
      },
      {
        "id": "",
        "name": "woodcockslincoln.world"
      },
      {
        "id": "",
        "name": "wolvesfc.com.au"
      },
      {
        "id": "",
        "name": "wizhotelz.eu"
      },
      {
        "id": "",
        "name": "windsofbalthera.com"
      },
      {
        "id": "",
        "name": "windersyf.com"
      },
      {
        "id": "",
        "name": "wilhelminapark.quest"
      },
      {
        "id": "",
        "name": "win2today.com"
      },
      {
        "id": "",
        "name": "wielkiezmagania.com"
      },
      {
        "id": "",
        "name": "westernunion-receiving82799.world"
      },
      {
        "id": "",
        "name": "westernunion-eu.cfd"
      },
      {
        "id": "",
        "name": "western-unlon.click"
      },
      {
        "id": "",
        "name": "westcordcity.world"
      },
      {
        "id": "",
        "name": "western-union.click"
      },
      {
        "id": "",
        "name": "westbay.top"
      },
      {
        "id": "",
        "name": "welkorfe.com"
      },
      {
        "id": "",
        "name": "weilongs.top"
      },
      {
        "id": "",
        "name": "webpaymentt-ch.com"
      },
      {
        "id": "",
        "name": "webhotelsls.com"
      },
      {
        "id": "",
        "name": "webhotelslim.com"
      },
      {
        "id": "",
        "name": "webhotelslim-5903.com"
      },
      {
        "id": "",
        "name": "webhotelslim-4501.com"
      },
      {
        "id": "",
        "name": "webhotelslim-4973.world"
      },
      {
        "id": "",
        "name": "webhotelslim-4201.com"
      },
      {
        "id": "",
        "name": "webhotelselc.com"
      },
      {
        "id": "",
        "name": "way102.com"
      },
      {
        "id": "",
        "name": "warsofzeltrion.com"
      },
      {
        "id": "",
        "name": "wardhostmarch.com"
      },
      {
        "id": "",
        "name": "wanktoad.com"
      },
      {
        "id": "",
        "name": "wallapop-es-id325235.info"
      },
      {
        "id": "",
        "name": "wait-reserve.com"
      },
      {
        "id": "",
        "name": "vyvic.xyz"
      },
      {
        "id": "",
        "name": "vusimasango.com"
      },
      {
        "id": "",
        "name": "vtunk-port-kalsyz.com"
      },
      {
        "id": "",
        "name": "vrf-apartments-rooms3452.com"
      },
      {
        "id": "",
        "name": "voucher-webmail.com"
      },
      {
        "id": "",
        "name": "voucher-receive.com"
      },
      {
        "id": "",
        "name": "voucher-mails.com"
      },
      {
        "id": "",
        "name": "voucher-imap.com"
      },
      {
        "id": "",
        "name": "volteretak.com"
      },
      {
        "id": "",
        "name": "vodafone-confirmation-order.cfd"
      },
      {
        "id": "",
        "name": "vivaprosta-uno.com"
      },
      {
        "id": "",
        "name": "visitorroom4873456.com"
      },
      {
        "id": "",
        "name": "vitalhotel.world"
      },
      {
        "id": "",
        "name": "visitor678412.help"
      },
      {
        "id": "",
        "name": "virginian-id8184.world"
      },
      {
        "id": "",
        "name": "visit.cyou"
      },
      {
        "id": "",
        "name": "virtual-onegolf.com"
      },
      {
        "id": "",
        "name": "vimarnrespay.sbs"
      },
      {
        "id": "",
        "name": "vimarnrespay.com"
      },
      {
        "id": "",
        "name": "villavitae.world"
      },
      {
        "id": "",
        "name": "villavitae.site"
      },
      {
        "id": "",
        "name": "villagevpn.com"
      },
      {
        "id": "",
        "name": "villa-la-brise.com"
      },
      {
        "id": "",
        "name": "vilarecife-id854.world"
      },
      {
        "id": "",
        "name": "vignetten-payment.info"
      },
      {
        "id": "",
        "name": "vignette-pay.live"
      },
      {
        "id": "",
        "name": "viewyourform24.click"
      },
      {
        "id": "",
        "name": "views-reserve.click"
      },
      {
        "id": "",
        "name": "viewmyform24.click"
      },
      {
        "id": "",
        "name": "view-resererve-en.com"
      },
      {
        "id": "",
        "name": "victoryhuddle.com"
      },
      {
        "id": "",
        "name": "viapay.cfd"
      },
      {
        "id": "",
        "name": "via-secure.de"
      },
      {
        "id": "",
        "name": "via-bezahlung.de"
      },
      {
        "id": "",
        "name": "versaillia.com"
      },
      {
        "id": "",
        "name": "verifyid5465-booking.com"
      },
      {
        "id": "",
        "name": "verifyid-guestcheck.com"
      },
      {
        "id": "",
        "name": "verifyid-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguets97678-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets96118-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets8948-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets85238-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets84511-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets8451-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets7851-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets74341-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets71561-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets67854-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets67841-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets645710-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets63451-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets6325170-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets61148-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets5710-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets56718-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets53548-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets52518-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets521218-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets3438-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets34178-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets321418-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets25148-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets241151-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets24111-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets21478-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets21378-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets1548-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets13118-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets12478-booking.com"
      },
      {
        "id": "",
        "name": "verifyguets12410-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest97861-booking.com"
      },
      {
        "id": "",
        "name": "verifyguests-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest9125-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest8765-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest78755-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest77681-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest77115-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest75956-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest7578-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest75541-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest7541-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest72125-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest67911-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest6541booking.com"
      },
      {
        "id": "",
        "name": "verifyguest6212-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest5651-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest5645-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest53115-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest4541-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest4158-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguest45251-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest4415-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest4148-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest4121-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest4113-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguest3768-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest3451-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest321-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest315788-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest31441-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest31125-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest26535-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest232919.world"
      },
      {
        "id": "",
        "name": "verifyguest1756-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest14513-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguest14428-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguest1435-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest1415-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest1355-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest13515-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest1318-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest1318-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguest0693-agoda.com"
      },
      {
        "id": "",
        "name": "verifyguest11215-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest04668-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest0267-booking.com"
      },
      {
        "id": "",
        "name": "verifyguest0247-booking.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Hospitality"
      },
      {
        "id": "",
        "name": "holidaysinfo.website"
      },
      {
        "id": "",
        "name": "econtpay.monster"
      },
      {
        "id": "",
        "name": "99564.website"
      },
      {
        "id": "",
        "name": "293712.website"
      }
    ]
  },
  "external_refs": [
    "https://raw.githubusercontent.com/netcraftcom/public-iocs/refs/heads/main/2025-11%20hotel%20phishing%20IOCs.csv",
    "https://www.netcraft.com/blog/thousands-of-domains-target-hotel-guests-in-massive-phishing-campaign",
    "https://otx.alienvault.com/pulse/69137fca8f856858d0543ded"
  ]
}