Крупная фишинговая кампания через Booking.com: как злоумышленники крадут банковские данные через официальные каналы

Механизм атаки основан на компрометации чатов бронирований: злоумышленники отправляют сообщения "Your reservation is at risk" через официальный интерфейс Booking.com, используя существующие диалоги между отелями и клиентами. Сообщения дублируются на email жертв, создавая эффект достоверности. Ссылки ведут на Tier 1-домены вида [hotel_name].[3_letters]-[2_letters].com (например, hostelmandarinkauxeh.eto-la[.]com), которые перенаправляют на Tier 2-ресурсы с паттерном booking.confirmation-id[5_numbers].com. На последних размещены фишинговые формы сбора платежных данных.

Ключевые индикаторы компрометации, выявленные через GTI:

• HTML-заголовки: "One moment..." (779 случаев), "AD not found (captcha2)" (46) и "Suspected phishing site | Cloudflare" (5).
• Мета-теги: URL изображений с ltdfoto[.]ru (126 вхождений) и bstatic.com (14), а также строки формата "Booking - [название_отеля]" (400+ экземпляров).
• Ключевые слова в доменах: "booking", "reservation", "id", "guest", "confirm" - их комбинации используются в 92% Tier 1- и 74% Tier 2-URL.

Техники threat hunting с использованием vt-py и Colab позволили выявить масштаб кампании:

• Анализ 1723 URL показал, что 52.6% выполняют перенаправление, а 47.4% содержат непосредственно фишинговые формы.
• Топ-10 доменов для редиректов включают booking.id5225211246[.]world (62 случая) и booking.confirmation-id9918[.]com (25).
• Распределение детектирования тревожит: 38% URL имеют 0 срабатываний антивирусов, 21% - лишь 1 детект.

Критичная находка - RAR-архив с данными жертв:

• Файлы Check-in_2023-10-06_to_2025-05-12.xls содержат детали бронирований: имена гостей, даты заезда, цены, статусы платежей.
• Текстовые файлы bookings_1714070330.txt включают 4727 записей формата "ID | Фишинг-URL | Имя_жертвы".
• HTML-логи раскрывают 118 Telegram-аккаунтов операторов (@dept_sales, @onlycashvvs и др.), координирующих кражу данных, включая номера карт и банки-эмитенты.

Исследование подтверждает: фишинг эволюционирует в сторону эксплуатации доверия к легитимным платформам. Низкая детектируемость (58% URL имеют ≤1 срабатывание) подчеркивает необходимость проактивного threat hunting на основе IoC, а не реактивных сигнатур.

Domains

• adjustofbooking.world
• alberguepereiryjzi.tyf-tm.com
• allallba.com
• apartmentsflateliojuwfd.mpo-op.com
• atochazwff.esfarhome.com
• authorizeyourbookstay.homes
• balmorahoteliirid.tur-ew.com
• barddesolkade.prt-cl.com
• baselupd.com
• berlin-mitte-checkupapprove.com
• bestahotelizeh.sit-bm.com
• bestwesternamsterdamhotel.world
• bestyourhotelmezepo.eto-la.com
• bokedashotelyss2025.world
• booking.26732-confirm.com
• booking.29335-reserve.com
• booking.986395-confirm.com
• booking.9865234-confirm.com
• booking.accountreservation.com
• booking.amendment-change.info
• booking.confirmation18442.com
• booking.confirmation-518306.com
• booking.confirmation-id0515.com
• booking.confirmation-id089172.com
• booking.confirmation-id10573.com
• booking.confirmation-id123573263.com
• booking.confirmation-id14332449.com
• booking.confirmation-id16238.com
• booking.confirmation-id1705.com
• booking.confirmation-id1712.com
• booking.confirmation-id1734.com
• booking.confirmation-id1736.com
• booking.confirmation-id1737.com
• booking.confirmation-id1740.com
• booking.confirmation-id17809.com
• booking.confirmation-id178716.com
• booking.confirmation-id1792.com
• booking.confirmation-id19173.com
• booking.confirmation-id19285.com
• booking.confirmation-id2183.com
• booking.confirmation-id37441.com
• booking.confirmation-id43812.com
• booking.confirmation-id4810.com
• booking.confirmation-id53942.com
• booking.confirmation-id542.com
• booking.confirmation-id5463626166.com
• booking.confirmation-id5473226.com
• booking.confirmation-id64241.com
• booking.confirmation-id70615.com
• booking.confirmation-id7101.com
• booking.confirmation-id7189.com
• booking.confirmation-id7573.com
• booking.confirmation-id76840.com
• booking.confirmation-id7903.com
• booking.confirmation-id81723.com
• booking.confirmation-id8245.com
• booking.confirmation-id84370.com
• booking.confirmation-id8634538.com
• booking.confirmation-id88166.com
• booking.confirmation-id89712.com
• booking.confirmation-id901823.com
• booking.confirmation-id9163.com
• booking.confirmation-id91753.com
• booking.confirmation-id92751.com
• booking.confirmation-id981721.com
• booking.confirmation-id99123.com
• booking.confirmation-id9989.com
• booking.confirmatios-guests.com
• booking.confirmstay-93614.com
• booking.form-guest67935.com
• booking.id136539.com
• booking.id455512201.world
• booking.id45782.com
• booking.id5225211246.world
• booking.id621386.world
• booking.reservation3108453.com
• booking.reservation649653.com
• booking.reservation-id1859.quest
• booking.senseorded.icu
• booking-on.co
• bookingvereficatioons.com
• booklng.conflrmation-ld634895.com
• booklng-guest-hub.com
• bookreserveingpage.com
• booksimplereg.com
• booksupreserves.com
• boxeguarifguastanis.com
• boxerefedengusfa.com
• boxeritogustarioferney.com
• boxesencampesgustario.com
• boxesiamanorhornas.com
• boxetenesgustafanius.com
• boxieshowardsergusta.com
• carlos3ubai.gstly.com
• casabluehotelskiahtosjesu.oiu-lk.com
• casanicolasxjlt.gstly.com
• chekisd-nowgustiport.com
• confirmation6437.com
• confirmation-id86722.info
• confirmationstay-08599283.com
• con-res-status.icu
• cont-wdn-stay.com
• dearhotelenez.pot-ut.com
• dearyouhotelnuci.mil-er.com
• dellenazionikvjo.gstshub.com
• denbros.store
• fareades-gusloaders.com
• fixbookrentrules.com
• fransisnouo.hubconnct.com
• fs.athletski.com
• goldenmtbm.newgsts.com
• google.com
• guestgo8723.world
• guestinportalreservationschecksins.com
• guestsportalesreservationschecksins.com
• guestsportalregistrationsarrivaes.com
• hereyouihotelumux.hir-yo.com
• hotelconfirmstay.cfd
• hotelgardesanaajuh.kl-zm.sbs
• hotelhighwaybedbreakfastraqe.ret-yu.com
• hotellespoirsuqi.mjn-kl.com
• hotelmadisonperi.xz-al.com
• hotelrivierasanremozazo.eto-pa.com
• hoteltermepatriasito.aet-po.com
• hotelyouwineden.eto-la.com
• hotelyouwinolaw.eto-la.com
• htellxlcfdwonn.ad-rescon.com
• infosystem5234.world
• jungleaquaparkogom.ait-ck.com
• lagopupurweexed.fero-min.com
• lepetitpremflbarop.com
• lorlandofuriosoobok.rew-th.com
• maisonfernandtepo.mnb-cv.com
• make-reserve.com
• make-reserved.com
• marcopolomaltajexe.ivi-ry.com
• myhotelstayportal.com
• mypagereserve.com
• mystay-id642.com
• nepligethotelogid.ivi-ry.com
• nobhilllyae.gt-bk.com
• nobhillucbl.gt-bk.com
• novumhotelbruyvozu.alp-qw.com
• octloverlfregrlserv.com
• palazzomottolatropeawita.mjn-kl.com
• property-id663.com
• ramadawynd.com
• redoorzhotelwawo.vrl-mp.com
• reserve.confirmes-id8531.com
• reserve-status-pending.com
• reservetion-id47119.world
• residencesanmarinoilow.ter-gl.com
• revomunich.confirm-id2971.world
• roomconf0818.world
• roomconf0917.world
• roomconf513.com
• roomerbookaproving409011.com
• room-summonses-id232123.com
• rsvnfjng.icestayland.com
• rsvnokwc.icestayland.com
• rsvnquif.stayiceland.com
• serenityalphabeachbave.zit-fl.com
• silvanaeecm.wlcmgst.com
• simplebookingi.com
• simpl-reservatron.com
• stayvhim.atdwellbell.com
• sunnydayspalmaviqa.zit-fl.com
• ta5fecb19.emailsys1a.net
• travelzone8312.com
• turismo-plazainbrazil.com
• verification.iatroupe.com
• veriu-queen.com
• vivabeachhmgx.rvrnscloud.com
• web-booking.net473.one
• westlightlisboamadalenauxox.eto-la.com
• youahotelikeg.agp-bv.com
• yourahotelabestxusa.spu-cr.com
• zoneform312.com

URLs

• http://bestyourhotelmezepo.eto-la.com/
• http://booking.26732-confirm.com/p/6816535923
• http://booking.986395-confirm.com/p/6919938285
• http://booking.confirmation-id0515.com/ZXTYWURHC
• http://booking.confirmation-id17809.com/idtjdzqq
• http://booking.confirmation-id2183.com/K1K59RPMB
• http://booking.senseorded.icu/bolewzay
• http://booking.senseorded.icu/ploptohb
• http://bookreserveingpage.com/abxvklay
• http://boxeguarifguastanis.com/4865004069
• http://boxieshowardsergusta.com/kpzenrr
• http://confirmation-id86722.info/3247680
• http://con-res-status.icu/nkzupnjo
• http://cont-wdn-stay.com/hixdgmfn
• http://dearhotelenez.pot-ut.com/
• http://dellenazionikvjo.gstshub.com/
• http://denbros.store/buy/198b5791
• http://fransisnouo.hubconnct.com/
• http://guestsportalregistrationsarrivaes.com/cwrjmfu
• http://hotelyouwineden.eto-la.com/
• http://htellxlcfdwonn.ad-rescon.com/
• http://jungleaquaparkogom.ait-ck.com/
• http://maisonfernandtepo.mnb-cv.com/
• http://marcopolomaltajexe.ivi-ry.com/
• http://reserve.confirmes-id8531.com/6784842359/
• http://silvanaeecm.wlcmgst.com/
• http://stayvhim.atdwellbell.com/
• http://travelzone8312.com/ybpdoeby
• http://veriu-queen.com/arrive
• http://westlightlisboamadalenauxox.eto-la.com/
• https://adjustofbooking.world/lijvrwtd/
• https://alberguepereiryjzi.tyf-tm.com/
• https://allallba.com/lbingwwk
• https://apartmentsflateliojuwfd.mpo-op.com/
• https://atochazwff.esfarhome.com/
• https://authorizeyourbookstay.homes/nizzyn/
• https://balmorahoteliirid.tur-ew.com/
• https://barddesolkade.prt-cl.com/
• https://baselupd.com/wilml
• https://berlin-mitte-checkupapprove.com/ajzbtrqd
• https://bestahotelizeh.sit-bm.com/
• https://bestwesternamsterdamhotel.world/cyosdoe
• https://bokedashotelyss2025.world/GPNNSZK%20https/bokedashotelyss2025.world/GPNNSZK
• https://booking.29335-reserve.com/p/6741458731
• https://booking.9865234-confirm.com/p/6914971938
• https://booking.9865234-confirm.com/p/6914971938/
• https://booking.accountreservation.com/p/3132067485/
• https://booking.amendment-change.info/p/6648834124/
• https://booking.confirmation18442.com/3274031065886
• https://booking.confirmation-518306.com/ubfuqefq
• https://booking.confirmation-id0515.com/ZXTYWURHC
• https://booking.confirmation-id089172.com/4926619051
• https://booking.confirmation-id089172.com/98322452
• https://booking.confirmation-id10573.com/4902629109
• https://booking.confirmation-id123573263.com/dzwzefst
• https://booking.confirmation-id14332449.com/26781264
• https://booking.confirmation-id16238.com/4331981997
• https://booking.confirmation-id1705.com/1743942327
• https://booking.confirmation-id1712.com/1747325660
• https://booking.confirmation-id1734.com/1750706745
• https://booking.confirmation-id1736.com/1749467953
• https://booking.confirmation-id1737.com/1743197069
• https://booking.confirmation-id1740.com/1745066139
• https://booking.confirmation-id178716.com/6828b137be11b98a1eb4dcce
• https://booking.confirmation-id178716.com/6829bf7fd370d951ac23b403
• https://booking.confirmation-id1792.com/1745850742
• https://booking.confirmation-id19173.com/1750407693
• https://booking.confirmation-id19285.com/4318556510
• https://booking.confirmation-id2183.com/K1K59RPMB
• https://booking.confirmation-id37441.com/56166239585609836870
• https://booking.confirmation-id43812.com/4530941440
• https://booking.confirmation-id4810.com/1744641466
• https://booking.confirmation-id53942.com/4432255840
• https://booking.confirmation-id542.com/1745175527
• https://booking.confirmation-id5463626166.com/edadlrfl
• https://booking.confirmation-id5473226.com/25550029
• https://booking.confirmation-id5473226.com/25655964
• https://booking.confirmation-id64241.com/26774129
• https://booking.confirmation-id64241.com/77768441
• https://booking.confirmation-id64241.com/etkcvzqj
• https://booking.confirmation-id70615.com/5346003564
• https://booking.confirmation-id7101.com/1741089930
• https://booking.confirmation-id7189.com/55250
• https://booking.confirmation-id7573.com/1749068717
• https://booking.confirmation-id76840.com/4715939806
• https://booking.confirmation-id7903.com/4808422716
• https://booking.confirmation-id81723.com/4483579832
• https://booking.confirmation-id8245.com/tuuiewhw
• https://booking.confirmation-id84370.com/4685688098
• https://booking.confirmation-id8634538.com/4366809154
• https://booking.confirmation-id88166.com/375
• https://booking.confirmation-id88166.com/4131041296
• https://booking.confirmation-id89712.com/4376023752
• https://booking.confirmation-id901823.com/4578643227
• https://booking.confirmation-id901823.com/4749717802/
• https://booking.confirmation-id9163.com/1748601141
• https://booking.confirmation-id91753.com/vkqchjjv
• https://booking.confirmation-id92751.com/1747261385
• https://booking.confirmation-id981721.com/4010709848
• https://booking.confirmation-id99123.com/4312023644
• https://booking.confirmation-id9989.com/4940350130
• https://booking.confirmatios-guests.com/p/6159594993
• https://booking.confirmstay-93614.com/ntyqgygr
• https://booking.form-guest67935.com/p/6938754627/
• https://booking.id136539.com/sewgnqq
• https://booking.id455512201.world/XS119C5C6
• https://booking.id45782.com/itbkzla
• https://booking.id5225211246.world/6WJCSCMOX
• https://booking.id5225211246.world/EXC3EHWYA
• https://booking.id5225211246.world/QR3B754Z5
• https://booking.id5225211246.world/WM5LP5N8E
• https://booking.id5225211246.world/Y72WFFHD7
• https://booking.id5225211246.world/ZPOCL8FBK
• https://booking.id621386.world/56KLW3FFT/
• https://booking.reservation3108453.com/p/6466818592
• https://booking.reservation649653.com/p/6936194424/
• https://booking.reservation-id1859.quest/24f45ye
• https://booking-on.co/secure-checkout/211636608
• https://booking-on.co/secure-checkout/211636608/
• https://bookingvereficatioons.com/zltvdns
• https://booklng.conflrmation-ld634895.com/1e47f3f6
• https://booklng.conflrmation-ld634895.com/22bc82a7
• https://booklng-guest-hub.com/375
• https://booksimplereg.com/4701168867
• https://booksupreserves.com/nrchcxqk
• https://boxerefedengusfa.com/4844159991
• https://boxeritogustarioferney.com/4490996324
• https://boxesencampesgustario.com/mpqrfmt
• https://boxesiamanorhornas.com/4830664671
• https://boxetenesgustafanius.com/4336445398
• https://carlos3ubai.gstly.com/
• https://casabluehotelskiahtosjesu.oiu-lk.com/
• https://casanicolasxjlt.gstly.com/
• https://chekisd-nowgustiport.com/WCDOVA2LS
• https://confirmation6437.com/1750069896
• https://confirmationstay-08599283.com/urofpjsy
• https://dearyouhotelnuci.mil-er.com/
• https://fareades-gusloaders.com/4529843563
• https://fixbookrentrules.com/jgbsvimc
• https://fransisnouo.hubconnct.com/
• https://fs.athletski.com/r/?re=1\u0026k=\u0026ss=98ce57ccbbad591834d6cd64a8860473
• https://goldenmtbm.newgsts.com/
• https://guestgo8723.world/idysmhqj
• https://guestinportalreservationschecksins.com/tgaqyoab
• https://guestsportalesreservationschecksins.com/nhwnotyw
• https://hereyouihotelumux.hir-yo.com/
• https://hotelconfirmstay.cfd/rBhupp/
• https://hotelgardesanaajuh.kl-zm.sbs/
• https://hotelhighwaybedbreakfastraqe.ret-yu.com/
• https://hotellespoirsuqi.mjn-kl.com/
• https://hotelmadisonperi.xz-al.com/
• https://hotelrivierasanremozazo.eto-pa.com/
• https://hoteltermepatriasito.aet-po.com/
• https://hotelyouwinolaw.eto-la.com/
• https://infosystem5234.world/yyfmepkk
• https://lagopupurweexed.fero-min.com/
• https://lepetitpremflbarop.com/wbkoamsb
• https://lorlandofuriosoobok.rew-th.com/
• https://make-reserve.com/chshcycs
• https://make-reserved.com/hebtbgbj/
• https://myhotelstayportal.com/bsmuijxh
• https://mypagereserve.com/6283515371
• https://mystay-id642.com/F4PASBJ8Q
• https://nepligethotelogid.ivi-ry.com/
• https://nobhilllyae.gt-bk.com/
• https://nobhillucbl.gt-bk.com/
• https://novumhotelbruyvozu.alp-qw.com/
• https://octloverlfregrlserv.com/axenexwb
• https://palazzomottolatropeawita.mjn-kl.com/
• https://property-id663.com/abecfvk
• https://ramadawynd.com/wakdl/
• https://redoorzhotelwawo.vrl-mp.com/
• https://reserve-status-pending.com/ddrattwm
• https://reservetion-id47119.world/6MDPG7QW1
• https://reservetion-id47119.world/6NHS1812N
• https://reservetion-id47119.world/UCXV2YO8E
• https://residencesanmarinoilow.ter-gl.com/
• https://revomunich.confirm-id2971.world/un1e1v6
• https://roomconf0818.world/375
• https://roomconf0917.world/375
• https://roomconf513.com/I2WPKN3H2
• https://roomerbookaproving409011.com/629v9qzb
• https://room-summonses-id232123.com/6466621791
• https://rsvnfjng.icestayland.com/
• https://rsvnokwc.icestayland.com/
• https://rsvnquif.stayiceland.com/
• https://serenityalphabeachbave.zit-fl.com/
• https://simplebookingi.com/varjwrig
• https://simpl-reservatron.com/yrovtsgp
• https://simpl-reservatron.com/zwqjzfpa
• https://sunnydayspalmaviqa.zit-fl.com/
• https://ta5fecb19.emailsys1a.net/c/194/8302770/820/0/2126401/265/498509/45646a6cd5.html
• https://turismo-plazainbrazil.com/rxcapmd
• https://verification.iatroupe.com/ccctejw
• https://vivabeachhmgx.rvrnscloud.com/
• https://web-booking.net473.one/payment/193477286
• https://www.google.com/amp/s/pignakomupd.info/juhqm
• https://youahotelikeg.agp-bv.com/
• https://yourahotelabestxusa.spu-cr.com/
• https://zoneform312.com/mznxwhsi