CIRCLE WITH A DOT

️ We’re seeing an ongoing phishing campaign targeting hotels and hosts, impersonating messages from 'Booking.com' - see sample image below.

Here’s what we know so far:

️ Emails appear to target actual 'Booking.com' host email addresses, which may indicate that recipient data was obtained from a previous breach - the timing is particularly relevant given the 'Booking.com' data breach last month (see article - https://www.bbc.co.uk/news/articles/cly00jnnxypo).

️ While the emails appear to come from 'Booking.com', they are actually sent via compromised accounts.

️ Messages typically reference a “complaint” or “special request” requiring urgent action.

️ Links often use URL shorteners or services like 'share.google' to hide phishing pages

️ Goal is to steal login credentials or payment details through fake portals

These phishing emails are very convincing, so extra caution is prudent - here are some steps you can take to reduce risk:

Be cautious of urgency or pressure in booking-related emails
Avoid clicking shortened or unfamiliar links
Verify requests by logging into the platform directly
Report suspicious emails internally or to the platform provider

#CyberSecurity #Phishing #ThreatIntel #InfoSec #BookingCom

Particularly noteworthy is "Bearhost", a related, long-standing service offering, which shut down on May 9, 2025.

However, it didn't take long for comeback attempts -- at this time, we link active Galeon LLC (AS211663) and aforementioned UFO TECHNOLOGIES LIMITED (AS201738) to this threat actor. Both networks trace back to St. Petersburg, Russia (and are included in our DROP and ASN-DROP lists).
https://www.spamhaus.org/blocklists/do-not-route-or-peer/ ️

The lack of proper vetting of UK corporations' officers details has long been exploited by miscreants (and criticized by investigators).

Thanks to recently strengthened regulation, https://find-and-update.company-information.service.gov.uk/company/17022120/officers proudly notes Davletshin's identity has been verified successfully. What remains to be sorted is the ability of bulletproof hosting operators to successfully establish shell corporations in the UK at all. 🧐

#OSINT #BulletproofHosting #Cybercrime #UK

Another day, another UK-based shell corporation utilized for nefarious purposes: UFO TECHNOLOGIES LIMITED, registered to the pictured address in Ipswich (which houses a co-working space) in February. Its director, Russian national Lenar I. Davletshin, is no stranger to cybercrime investigators; related internet infrastructure and corporate entities have repeatedly been linked to bulletproof hosting. ️

RE: https://infosec.exchange/@spamhaus/116477165755475205

UPDATE: Commencing April 19, victims came under siege from a botnet spam campaign advertising erectile dysfunction medication to them.

The vast majority of these spam emitters are behind dial-up IPs at Chinese ISPs, causing a +268% XBL listing increase at China Mobile Communications Corporation's networks in particular, pushing this ISP to rank #1 of our top 10:

https://www.spamhaus.org/reputation-statistics/networks/exploit/

Interestingly, some emissions are also seen out of turkcell[.]com[.]tr's networks.

The quality of these pills (should they be delivered at all) is anyone's guess -- from our perspective however, should they be as low-quality as the spam campaign advertising them, we'd strongly recommend against taking them.

#Spam #Botnet #ReputationStatistics

The network currently has 14 Spamhaus Blocklist (SBL) listings for IPs under its responsibility:

 https://check.spamhaus.org/sbl/listings/chinamobile.com/

With a +338% ️ increase, China-based telecoms provider “chinamobile[.]com” ranks #1 for hosting IP space associated with exploited devices, with 277,765 detections over the last 30 days.

Detections on the Exploits Blocklist began rising on April 19th, with a sharp spike between April 23rd and April 24th, increasing by over 40,000 detections (from 71,377 to 111,514).

 https://www.spamhaus.org/reputation-statistics/networks/exploit/

#ThreatIntel #InfoSec