Help Net Security: rooms-home93914.space fake holiday rental phishing
Fortra researchers found fake holiday rental pages, such as on rooms-home93914.space, copying real listings to steal logins and card details. The real platforms are not involved.
- First reported
- Reports
- 1
Source: helpnetsecurity.com · published
What happened
Help Net Security reported on 6 November 2026 on research by Fortra's FIRE team, whose analyst Elyse Neumann described phishing sites that copy popular holiday rental platforms. According to the report, the pages reproduce host names, ratings, reviews and listings copied from real properties in order to collect account passwords, personal details and credit card numbers. One example used the lookalike address confirm-[redacted].rooms-home93914[.]space, impersonating a global experiences and lodging platform. The real platforms are impersonated and are not involved.
How the scam works
The researchers found several flows. In one, a sign-up prompt asked visitors for contact details and social media credentials before they could continue. In another, the page told the visitor that a reservation was unconfirmed and pushed a confirm-and-pay step that asked for a name, email address, country and phone number, followed by card details. Some pages included a live chat in which a supposed agent vouched for the card form and encouraged the victim to complete payment, making the process feel like normal customer service.
Because the listings, photos and reviews are copied from genuine properties, the pages can look exactly like the platform a traveller has been browsing. Links typically arrive in messages from a supposed host or in emails or texts about a booking, and the subdomain begins with words such as confirm so that the address looks routine at a glance. Any payment made on such a page goes to the criminals and no booking exists, and stolen credentials can be used to take over the traveller's real account.
Genuine rental platforms handle payment inside their own website or app, and hosts should not ask guests to pay or confirm through an outside link. Travellers who entered card numbers should contact their card issuer, and anyone who typed a password should change it on the real platform and enable two-step verification.
Source
Help Net Security, 6 November 2026, reporting Fortra FIRE research: https://www.helpnetsecurity.com/2026/11/06/holiday-rental-platform-phishing-travelers/
Red flags
- A booking or confirmation link on an unfamiliar domain such as rooms-home93914.space.
- A message saying your reservation is unconfirmed and must be paid now.
- A sign-up form asking for social media login details.
- A live chat agent urging you to enter your card details on the page.
- A host asking you to pay or communicate outside the official platform.
If you were targeted
- 1Book and pay only inside the official rental website or app.
- 2Do not follow confirmation or payment links sent by email, text or chat.
- 3Check the address bar; the real platform's domain must match exactly.
- 4If you entered card details, contact your card issuer at once.
- 5If you entered a password, change it on the real platform and turn on two-step verification.