# Fake holiday rental booking phishing sites use live chat to harvest traveler credentials and card data

> Fortra's Intelligence and Research Experts (FIRE) team documented phishing sites impersonating a short-term lodging and experiences marketplace. The sites clone legitimate listings, use lookalike domains and urgent reservation/payment messaging, and staff a live chat that reassures hesitant victims into submitting passwords, personal details and credit card data.

- **Published:** 2026-11-06T05:30:44Z
- **Last reviewed:** 2026-11-06T05:30:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5374
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5374.png
- **ID:** TL-2026-5374
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 2 (1 shown free below)

## Description

Help Net Security (2026-11-06) reports research by Fortra's FIRE team on fake holiday rental booking platforms that mimic legitimate short-term lodging marketplaces. The impersonated brand is redacted in the article and the Fortra primary post could not be retrieved during this analysis (HTTP 403), so brand-level detail is not available.

The sites copy property photos, descriptions, host names, ratings and reviews from genuine listings and are hosted on lookalike domains. The only infrastructure pattern published is confirm-[redacted].rooms-home93914[.]space. Lures create urgency: an unconfirmed reservation, a payment-processing warning, or a threat of booking cancellation. Fortra's Elyse Neumann notes that travelers are more likely to click quickly as a trip approaches.

The victim flow has several stages: a fake sign-in page that asks for a password (and social media credentials), then a multi-step verification flow collecting name, email, phone number and country, then a credit card form presented as a mandatory security check with assurances that no charge will be made. A live chat support agent answers hesitant victims and gives false reassurance about the payment form and verification steps. This human-in-the-loop element is the notable technique in this campaign.

Source limitations: no CVE, malware family, threat actor, delivery vector (email, ad, SMS) or hosting detail is stated. Severity is an analyst assessment. A web search snippet suggested rooms-home93914.space may be a Fortra-operated phishing-simulation domain, but the Fortra simulation notice page that was fetched did not mention this domain, so the claim is unverified. Treat the domain as a reported indicator pending confirmation. BeaconBeagle was unreachable (HTTP 502), so no C2 correlation was possible, and this is not a C2/malware threat.

## MITRE ATT&CK

- T1583.001 Domains
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake Holiday Rental Phishing — POST to Lookalike Booking Domain (Credential/Card Submission)** (`TL-2026-5374-SPL-002`)

Detects HTTP POST requests to booking-themed lookalike hosts (confirm-/reservation-/booking-/secure-/verify- labels on low-cost TLDs) or the reported rooms-home93914.space, indicating a user submitted a form on a fake reservation site. Covers the sign-in, verification and card stages of the reported flow.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1598.003, T1657, T1656, T1589.001
- **Data sources:** web_proxy, splunk_cim_web, sentinel_commonsecuritylog
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web.Web where earliest=-24h@h Web.http_method=POST by Web.src Web.user Web.url
| rename Web.* as *
| eval host=lower(replace(url,"^(?:[a-z]+://)?([^/:?#]+).*$","\1"))
| where match(host,"^(confirm|reservation|booking|secure|verify)-[a-z0-9-]+\.[a-z0-9-]+\.(space|top|xyz|click|online|site|shop|cfd|sbs|icu)$") OR like(host,"%rooms-home93914.space")
| stats sum(count) as posts min(firstTime) as firstTime max(lastTime) as lastTime values(url) as urls by src user host
| convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| extend Host = tolower(tostring(parse_url(RequestURL).Host))
| where Host matches regex @"^(confirm|reservation|booking|secure|verify)-[a-z0-9-]+\.[a-z0-9-]+\.(space|top|xyz|click|online|site|shop|cfd|sbs|icu)$" or Host endswith "rooms-home93914.space"
| summarize Posts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, SourceUserName, Host
| order by LastSeen desc
```

### Sigma

```yaml
title: Fake Holiday Rental Phishing - POST to Booking Lookalike Domain
id: 8d2e4f60-7a19-4b3c-b5d8-6c0e91a7f202
status: experimental
description: Detects HTTP POST requests to booking-themed lookalike hosts on low-cost TLDs or to rooms-home93914.space, consistent with credential and card submission on a fake holiday rental site.
references:
    - https://www.helpnetsecurity.com/2026/11/06/holiday-rental-platform-phishing-travelers/
    - https://attack.mitre.org/techniques/T1598/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.reconnaissance
    - attack.t1598.003
    - attack.impact
    - attack.t1657
    - attack.defense-evasion
    - attack.t1656
    - attack.t1589.001
logsource:
    category: proxy
detection:
    selection_method:
        cs-method: 'POST'
    selection_lookalike:
        cs-host|re: '^(confirm|reservation|booking|secure|verify)-[a-z0-9-]+\.[a-z0-9-]+\.(space|top|xyz|click|online|site|shop|cfd|sbs|icu)$'
    selection_ioc:
        cs-host|endswith: 'rooms-home93914.space'
    condition: selection_method and (selection_lookalike or selection_ioc)
falsepositives:
    - Legitimate sites using confirm-/verify-/secure- host labels on low-cost TLDs
    - Internal or partner applications on such domains
level: high

```

**Known false positives:**

- Legitimate services with confirm-/verify-/secure- hostnames on low-cost TLDs
- Corporate travel tools hosted on unusual TLDs

**Tuning notes:** Heuristic regex on host label plus TLD; extend the TLD list to your threat landscape and allowlist known-good hosts. If CEF RequestURL lacks a scheme, parse_url returns an empty host; prefix https:// first. Hits mean data was submitted: reset credentials and contact the card issuer.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Holiday Rental Phishing — confirm-* Subdomain on Low-Cost TLD (Lookalike Infrastructure) (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — User Click on Lookalike Booking Link From Email (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — Multi-Step Form Submission Sequence on Lookalike Host (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — DNS Resolution of [indicator] (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — Data Submission POST to [indicator] (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — Reservation Lure Landing Paths on Lookalike Host (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — Web Proxy Access to [indicator] (Exploitation) (locked: unlock with TL Creds)
- Fake Holiday Rental Phishing — Live Chat Widget Loaded From Lookalike Booking Page (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 2)

Defanged, TLP:CLEAR.

- Domain: `rooms-home93914[.]space`

Full set of 2 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fortra: Fake holiday rental sites can steal more than your travel plans (primary research, linked from Help Net Security; fetch returned HTTP 403, content not independently read)](https://www.fortra.com/blog/fake-holiday-rental-sites-can-steal-more-your-travel-plans)
- [Rental phishing sites use live chat to win over hesitant travelers](https://www.helpnetsecurity.com/2026/11/06/holiday-rental-platform-phishing-travelers/)
- [Fake Travel Sites Target Vacationers with Fake Bookings (related context: cloned travel-booking domains)](https://www.brandshield.com/newsroom/fake-travel-sites-fake-bookings)
- [Phishing domains for the holidays (related context: booking-site lookalike domain registrations)](https://gurucul.com/latest-threats/phishing-domains-for-the-holidays/)
- [Forbes Advisor: Beware Of These Vacation Rental Scams That Con Guests And Hosts (Fortra, related context)](https://www.fortra.com/resources/press-releases/forbes-advisor-beware-these-vacation-rental-scams-con-guests-and-hosts)
- [US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns (general holiday phishing guidance)](https://www.cisa.gov/news-events/alerts/2014/11/24/us-cert-alerts-users-holiday-phishing-scams-and-malware-campaigns)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5374