PhishEye
|Incident Response
ID: PE-1F35BA60
Ref: kBVMz50-

Phishing Attack Detected

Our security systems have identified an active phishing campaign targeting Booking. The technical evidence we hold is set out below.

Domainbooking.confirm-id12985.com
IP Address172.67.167.169
http://booking.confirm-id12985.com
Active

Capturing screenshot…

Screenshot of booking.confirm-id12985.com

Technical Details

Time Active
Since 2026-09-18 02:22:49 UTC
First Reported
2026-09-18
IP Address
172.67.167.169
Hosting Provider
Cloudflare, Inc.
Registry
Dominet (HK) Limited

Browser compatibility notice: some elements may vary in appearance.

Recommended Actions

  1. 1.

    Remove the identified files and directories immediately to mitigate risk to end-users.

  2. 2.

    Escalate to your website administrator or hosting provider if manual removal is not possible.

  3. 3.

    Conduct a security audit to identify the vulnerability used to compromise the server.

Report Feedback

If you believe this report is inaccurate or was sent to you in error, please let us know so we can improve our detection systems.