Skip to navigation

Threat reportPhishingTL-2026-5374

Fake holiday rental booking phishing sites use live chat to harvest traveler credentials and card data

mediumACTIVE

Fortra's Intelligence and Research Experts (FIRE) team documented phishing sites impersonating a short-term lodging and experiences marketplace. The sites clone legitimate listings, use lookalike domains and urgent reservation/payment messaging, and staff a live chat that reassures hesitant victims into submitting passwords, personal details and credit card data.

Key facts for Fake holiday rental phishing

IdentifiersTL-2026-5374
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
ToolsFortra
MITRE ATT&CK techniquesT1204.001 Malicious Link, T1566.002 Spearphishing Link, T1583.001 Domains, T1598.003 Spearphishing Link, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorstravel, hospitality, consumer, online-marketplaces
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for Fake holiday rental phishing

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5374 across Splunk SPL, Microsoft KQL and Sigma, covering 2 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake Holiday Rental Phishing — POST to Lookalike Booking Domain (Credential/Card Submission)

Detects HTTP POST requests to booking-themed lookalike hosts (confirm-/reservation-/booking-/secure-/verify- labels on low-cost TLDs) or the reported rooms-home93914.space, indicating a user submitted a form on a fake reservation site. Covers the sign-in, verification and card stages of the reported flow.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1598.003, T1657, T1656, T1589.001
  • Data sources: web_proxy, splunk_cim_web, sentinel_commonsecuritylog
  • Severity: high
  • Confidence: medium

Splunk SPL

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web.Web where earliest=-24h@h Web.http_method=POST by Web.src Web.user Web.url
| rename Web.* as *
| eval host=lower(replace(url,"^(?:[a-z]+://)?([^/:?#]+).*$","\1"))
| where match(host,"^(confirm|reservation|booking|secure|verify)-[a-z0-9-]+\.[a-z0-9-]+\.(space|top|xyz|click|online|site|shop|cfd|sbs|icu)$") OR like(host,"%rooms-home93914.space")
| stats sum(count) as posts min(firstTime) as firstTime max(lastTime) as lastTime values(url) as urls by src user host
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| extend Host = tolower(tostring(parse_url(RequestURL).Host))
| where Host matches regex @"^(confirm|reservation|booking|secure|verify)-[a-z0-9-]+\.[a-z0-9-]+\.(space|top|xyz|click|online|site|shop|cfd|sbs|icu)$" or Host endswith "rooms-home93914.space"
| summarize Posts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, SourceUserName, Host
| order by LastSeen desc

Sigma

title: Fake Holiday Rental Phishing - POST to Booking Lookalike Domain
id: 8d2e4f60-7a19-4b3c-b5d8-6c0e91a7f202
status: experimental
description: Detects HTTP POST requests to booking-themed lookalike hosts on low-cost TLDs or to rooms-home93914.space, consistent with credential and card submission on a fake holiday rental site.
references:
    - https://www.helpnetsecurity.com/2026/11/06/holiday-rental-platform-phishing-travelers/
    - https://attack.mitre.org/techniques/T1598/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.reconnaissance
    - attack.t1598.003
    - attack.impact
    - attack.t1657
    - attack.defense-evasion
    - attack.t1656
    - attack.t1589.001
logsource:
    category: proxy
detection:
    selection_method:
        cs-method: 'POST'
    selection_lookalike:
        cs-host|re: '^(confirm|reservation|booking|secure|verify)-[a-z0-9-]+\.[a-z0-9-]+\.(space|top|xyz|click|online|site|shop|cfd|sbs|icu)$'
    selection_ioc:
        cs-host|endswith: 'rooms-home93914.space'
    condition: selection_method and (selection_lookalike or selection_ioc)
falsepositives:
    - Legitimate sites using confirm-/verify-/secure- host labels on low-cost TLDs
    - Internal or partner applications on such domains
level: high

Known false positives:

  • Legitimate services with confirm-/verify-/secure- hostnames on low-cost TLDs
  • Corporate travel tools hosted on unusual TLDs

Tuning notes: Heuristic regex on host label plus TLD; extend the TLD list to your threat landscape and allowlist known-good hosts. If CEF RequestURL lacks a scheme, parse_url returns an empty host; prefix https:// first. Hits mean data was submitted: reset credentials and contact the card issuer.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Fake Holiday Rental Phishing — confirm-* Subdomain on Low-Cost TLD (Lookalike Infrastructure) · unlock with TL Creds
  • Fake Holiday Rental Phishing — User Click on Lookalike Booking Link From Email · unlock with TL Creds
  • Fake Holiday Rental Phishing — Multi-Step Form Submission Sequence on Lookalike Host · unlock with TL Creds
  • Fake Holiday Rental Phishing — DNS Resolution of [indicator] · unlock with TL Creds
  • Fake Holiday Rental Phishing — Data Submission POST to [indicator] · unlock with TL Creds
  • Fake Holiday Rental Phishing — Reservation Lure Landing Paths on Lookalike Host · unlock with TL Creds
  • Fake Holiday Rental Phishing — Web Proxy Access to [indicator] (Exploitation) · unlock with TL Creds
  • Fake Holiday Rental Phishing — Live Chat Widget Loaded From Lookalike Booking Page · unlock with TL Creds

Indicators of compromise for Fake holiday rental phishing

As of 2026-11-06, Threadlinqs Intelligence tracks 2 indicators of compromise for TL-2026-5374.

Sample indicators (1 of 2)

  • Domain: rooms-home93914[.]space

Defanged, TLP:CLEAR. Full set of 2 indicators: unlock with TL Creds.

2 indicators of compromise · unlock with TL Creds. Compare plans

How Fake holiday rental phishing works

Help Net Security (2026-11-06) reports research by Fortra's FIRE team on fake holiday rental booking platforms that mimic legitimate short-term lodging marketplaces. The impersonated brand is redacted in the article and the Fortra primary post could not be retrieved during this analysis (HTTP 403), so brand-level detail is not available.

The sites copy property photos, descriptions, host names, ratings and reviews from genuine listings and are hosted on lookalike domains. The only infrastructure pattern published is confirm-[redacted].rooms-home93914[.]space. Lures create urgency: an unconfirmed reservation, a payment-processing warning, or a threat of booking cancellation. Fortra's Elyse Neumann notes that travelers are more likely to click quickly as a trip approaches.

The victim flow has several stages: a fake sign-in page that asks for a password (and social media credentials), then a multi-step verification flow collecting name, email, phone number and country, then a credit card form presented as a mandatory security check with assurances that no charge will be made. A live chat support agent answers hesitant victims and gives false reassurance about the payment form and verification steps. This human-in-the-loop element is the notable technique in this campaign.

Source limitations: no CVE, malware family, threat actor, delivery vector (email, ad, SMS) or hosting detail is stated. Severity is an analyst assessment. A web search snippet suggested rooms-home93914.space may be a Fortra-operated phishing-simulation domain, but the Fortra simulation notice page that was fetched did not mention this domain, so the claim is unverified. Treat the domain as a reported indicator pending confirmation. BeaconBeagle was unreachable (HTTP 502), so no C2 correlation was possible, and this is not a C2/malware threat.

MITRE ATT&CK techniques by tactic:

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains

Reconnaissance

T1598.003 Spearphishing Link

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for Fake holiday rental phishing

Immediate actions

  • Block or sinkhole rooms-home93914.space and its subdomains (confirm-*.rooms-home93914.space) at DNS and web proxy pending confirmation of ownership
  • Hunt proxy and DNS logs for visits to *.rooms-home93914.space and similar lookalike booking domains
  • Reset passwords and review account activity for users who entered credentials on a suspected fake booking page
  • Contact the card issuer for any user who submitted card details to a suspected fake booking site

Workarounds

  • Verify the official website address before entering credentials
  • Do not click links in unsolicited communications
  • Confirm reservations independently through the official platform or app
  • Inspect URLs carefully rather than relying on page appearance

Longer-term hardening

  • Run security awareness training on urgent reservation and payment-failure lures and on live-chat reassurance as a social engineering tactic
  • Monitor newly registered lookalike domains of travel and lodging brands
  • Use phishing-resistant MFA and password managers, which do not autofill on lookalike domains

Timeline of Fake holiday rental phishing

  • Context: US-CERT publishes an alert warning users about holiday phishing scams and malware campaigns, showing the seasonal pattern predates this campaign.
  • Context: Gurucul publishes research on holiday-season phishing domains, including registrations impersonating booking sites (unfetched search-result summary; not tied to this campaign).
  • Context: BrandShield reports cloned travel-booking domains offering nonexistent bookings, showing the broader fake-travel-site trend.
  • Campaign opened for tracking on the Threadlinqs platform (TL-2026-5374); the Fortra primary post was inaccessible (HTTP 403) and no BeaconBeagle data was available (HTTP 502).
  • Help Net Security reports Fortra FIRE research on fake holiday rental sites that use live chat to win over hesitant travelers.
  • The Help Net Security article links Fortra's primary FIRE blog post, 'Fake holiday rental sites can steal more than your travel plans'; the Fortra page returned HTTP 403 and could not be read directly.

Sources cited for Fake holiday rental phishing

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats