CIRCLE WITH A DOT

️ We’re seeing an ongoing phishing campaign targeting hotels and hosts, impersonating messages from 'Booking.com' - see sample image below.Here’s what we know so far: ️ Emails appear to target actual 'Booking.com' host email addresses, which may indicate that recipient data was obtained from a previous breach - the timing is particularly relevant given the 'Booking.com' data breach last month (see article - https://www.bbc.co.uk/news/articles/cly00jnnxypo). ️ While the emails appear to come from 'Booking.com', they are actually sent via compromised accounts. ️ Messages typically reference a “complaint” or “special request” requiring urgent action. ️ Links often use URL shorteners or services like 'share.google' to hide phishing pages ️ Goal is to steal login credentials or payment details through fake portalsThese phishing emails are very convincing, so extra caution is prudent - here are some steps you can take to reduce risk: Be cautious of urgency or pressure in booking-related emails Avoid clicking shortened or unfamiliar links Verify requests by logging into the platform directly Report suspicious emails internally or to the platform provider#CyberSecurity #Phishing #ThreatIntel #InfoSec #BookingCom

Particularly noteworthy is "Bearhost", a related, long-standing service offering, which shut down on May 9, 2025.However, it didn't take long for comeback attempts -- at this time, we link active Galeon LLC (AS211663) and aforementioned UFO TECHNOLOGIES LIMITED (AS201738) to this threat actor. Both networks trace back to St. Petersburg, Russia (and are included in our DROP and ASN-DROP lists). https://www.spamhaus.org/blocklists/do-not-route-or-peer/ ️

RE: https://infosec.exchange/@spamhaus/116477165755475205UPDATE: Commencing April 19, victims came under siege from a botnet spam campaign advertising erectile dysfunction medication to them. The vast majority of these spam emitters are behind dial-up IPs at Chinese ISPs, causing a +268% XBL listing increase at China Mobile Communications Corporation's networks in particular, pushing this ISP to rank #1 of our top 10: https://www.spamhaus.org/reputation-statistics/networks/exploit/Interestingly, some emissions are also seen out of turkcell[.]com[.]tr's networks.The quality of these pills (should they be delivered at all) is anyone's guess -- from our perspective however, should they be as low-quality as the spam campaign advertising them, we'd strongly recommend against taking them. #Spam #Botnet #ReputationStatistics

The network currently has 14 Spamhaus Blocklist (SBL) listings for IPs under its responsibility:  https://check.spamhaus.org/sbl/listings/chinamobile.com/