CampaignPublished 11 Nov 2025

Thousands of Fake Hotel Domains Used in Massive Phishing Campaign

Source AlienVault OTX General

Description

A Russian-speaking threat actor is conducting a large-scale phishing campaign targeting travelers by registering over 4,300 fake hotel and travel-related domains impersonating brands like Airbnb and Booking.com. The campaign uses sophisticated phishing sites with customized pages, fake CAPTCHA, and multilingual support to appear legitimate. Malicious emails redirect victims through multiple sites before landing on phishing pages designed to steal payment card data. The attacker continuously registers new domains with travel-related naming conventions, focusing on specific registrars. The phishing kit collects data in real-time and contains Russian language elements. This campaign poses a medium severity risk due to its scale, sophistication, and potential financial impact on victims. European organizations in the travel, hospitality, and financial sectors should be vigilant. Countries with high tourism and travel service usage, such as the UK, Germany, France, Spain, and Italy, are most likely to be affected. Mitigation requires targeted detection of phishing domains, enhanced email filtering, user awareness training focused on travel scams, and collaboration with domain registrars to disrupt domain registrations.

Impact

For European organizations, this campaign presents significant risks primarily to the travel, hospitality, and financial sectors. Travelers and customers in Europe are likely targets due to the high volume of tourism and online bookings involving brands like Airbnb and Booking.com. Stolen payment card data can lead to financial fraud, chargebacks, and reputational damage for affected businesses. Financial institutions may face increased fraud investigations and losses. Additionally, the presence of numerous phishing domains can erode consumer trust in legitimate travel services. The multilingual nature of the phishing sites increases the likelihood of successful attacks across diverse European populations. Organizations facilitating travel bookings or payments may experience increased customer support burdens and potential regulatory scrutiny under GDPR for failing to protect customer data. The campaign's persistence and scale could also strain cybersecurity resources and necessitate ongoing monitoring and response efforts.

Defensive guidance

European organizations should implement targeted domain monitoring to detect and block newly registered domains that mimic travel brands, focusing on those with travel-related keywords and suspicious registrars. Email security solutions must be tuned to identify and quarantine phishing emails with complex redirection chains and suspicious URL patterns. Deploy advanced URL filtering and sandboxing to analyze redirected links before user access. Conduct specialized user awareness training emphasizing the risks of travel-related phishing scams, including recognizing fake CAPTCHAs and unusual URL structures. Collaborate with domain registrars and industry groups to report and take down fraudulent domains rapidly. Financial institutions should enhance transaction monitoring for anomalies linked to travel-related purchases. Organizations should also implement multi-factor authentication for customer accounts where possible to reduce the impact of credential theft. Finally, maintain updated threat intelligence feeds and integrate indicators of compromise related to this campaign into security operations.

Summary

This phishing campaign, attributed to a Russian-speaking threat actor, involves the registration of over 4,300 fraudulent domains since early 2025, designed to impersonate major travel brands such as Airbnb and Booking.com. The attacker employs sophisticated techniques to enhance the legitimacy of phishing sites, including customized landing pages that vary based on unique URL parameters, fake CAPTCHA challenges to mimic genuine user interactions, and multilingual translations to target a broad international audience. The phishing emails use complex redirection chains through multiple intermediary sites before directing victims to the final phishing page, complicating detection and blocking efforts. The domains are registered primarily through select registrars, using naming conventions that incorporate travel-related keywords and hotel names to increase credibility. The phishing kit used in this campaign supports real-time data collection of stolen payment card information and contains Russian language code elements, indicating the origin or preferred language of the attacker. Although no direct exploits or malware payloads are involved, the campaign leverages social engineering and domain impersonation to harvest sensitive financial data from travelers. The scale and continuous domain registration efforts demonstrate a persistent and resourceful adversary aiming to exploit the travel sector's high volume of online transactions and user trust in well-known brands.

Indicators of compromise

Domains 4,319

0lala-hom.rest
1-stvilla-reservation-completion.com
12487guest-booking.com
13148verifyguets-booking.com
15125guest-booking.com
1626266.com
166616.xyz
2020000542.world
2025statementreservations.quest
21323123.cyou

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Nov 2025, 18:40 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Domains 4,319

Community reviews

Related threats