Netcraft-linked phishing cluster uses fake Booking.com-style hotel reservation pages to steal cards

What happened

Offseq Threat Radar published a summary on 9 November 2026 of an AlienVault OTX pulse that references Netcraft's 6 November 2026 blog post. It describes a phishing campaign targeting hospitality customers by impersonating Booking.com and other hotel services with fake reservation pages. Booking.com and the hotels named on those pages are impersonated and are not involved.

How the scam works

According to the summary, the pages use personalized reservation details, real-time card validation, interactive verification workflows and multi-language support, focus on Japanese hotels, and can prompt additional verification after the card is submitted. The stated aim is stealing payment card information and credentials. Listed indicator domains include homesdowttups.com, gardenstokyjp.com, goldeshoms.com, hotelchecckrsrv-krwo.world, reserv-advanced67746202.com and advanced-reserv882689.com.

Fake booking pages work because travellers expect to confirm or pay for a reservation, and seeing their own name, dates or hotel on the page makes the request feel genuine. Real-time card checks and extra verification steps after the first payment copy the flow of legitimate booking sites. Links typically arrive by email or message about a reservation that needs confirming, updating or paying.

Book and pay only inside the official Booking.com app or website, or the hotel's own verified channels. Anyone who entered card details on one of the listed domains should contact their card issuer at once, and anyone who entered a booking-account password should change it on the real site and enable two-step verification. The Offseq summary and the Netcraft research it references have not been independently re-checked by scammers.com.

Source

Offseq Threat Radar summary (citing AlienVault OTX / Netcraft), 9 November 2026: https://radar.offseq.com/threat/the-industry-leader-in-enterprise-brand-protection-93854c94338c195b