Rental phishing sites use live chat to win over hesitant travelers
Law enforcement has taken action against Rental phishing, according to the latest reporting on the case.
Law enforcement has taken action against Rental phishing, according to the latest reporting on the case.
Holiday travelers looking for a place to stay are landing on copies of popular rental platforms, complete with host names, ratings and reviews, that ask for their passwords, personal details and credit card numbers.
The sites, spotted and taken down by Fortra’s Intelligence and Research Experts (FIRE) team, rely on familiar branding, copied property listings and reservation details, along with urgent messages meant to rush visitors into acting.
Visitors are told their reservation is unconfirmed, their payment has not been processed or their booking will be canceled.
One phishing site impersonated a global experiences and lodging platform, using a lookalike address (confirm-[redacted].rooms-home93914[.]space) and imagery matching the brand.
In another case, the booking flow led to a confirm and pay screen marking the reservation as Visitors were told to complete a mandatory verification process before the booking could go ahead and were assured it would cost nothing extra.
Past victims of Rental phishing are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.
Travel bookings tend to involve high prices, tight deadlines and limited availability, and the fake sites play on that urgency.
This type of page can be used to collect account information, phone numbers, or login credentials.
Taking down the infrastructure is real progress, but the skills and the playbook behind it don't disappear with the servers -- treat this as a disruption, not a resolution.
If travelers reuse passwords across services, information submitted to a fake booking site could also put other accounts at risk, Neumann explained.
A convincing property listing can be copied, but the official website address is much harder for a scammer to imitate, concluded Neumann.
This action was brought by law enforcement, which is the body to watch for further updates.
The sign-up prompt asked for contact details and social media credentials.
Her advice is to steer clear of entering credentials after following an unsolicited link, Attackers copy photos and descriptions from legitimate properties, so judging a site by its looks gets hard.
Rental phishing is now dealing with an active legal process, with the agency involved leading the action.
The chat responded directly to the visitor’s concerns and presented the card request as a routine security check.
If your environment shows any indicators associated with Rental phishing, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.
Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.
What happened
Law enforcement has taken action against Rental phishing, according to the latest reporting on the case.
Holiday travelers looking for a place to stay are landing on copies of popular rental platforms, complete with host names, ratings and reviews, that ask for their passwords, personal details and credit card numbers.
The sites, spotted and taken down by Fortra’s Intelligence and Research Experts (FIRE) team, rely on familiar branding, copied property listings and reservation details, along with urgent messages meant to rush visitors into acting.
What changed
Visitors are told their reservation is unconfirmed, their payment has not been processed or their booking will be canceled.
One phishing site impersonated a global experiences and lodging platform, using a lookalike address (confirm-[redacted].rooms-home93914[.]space) and imagery matching the brand.
In another case, the booking flow led to a confirm and pay screen marking the reservation as Visitors were told to complete a mandatory verification process before the booking could go ahead and were assured it would cost nothing extra.
Who is affected
Past victims of Rental phishing are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.
Travel bookings tend to involve high prices, tight deadlines and limited availability, and the fake sites play on that urgency.
This type of page can be used to collect account information, phone numbers, or login credentials.
Why it matters
Taking down the infrastructure is real progress, but the skills and the playbook behind it don't disappear with the servers -- treat this as a disruption, not a resolution.
If travelers reuse passwords across services, information submitted to a fake booking site could also put other accounts at risk, Neumann explained.
A convincing property listing can be copied, but the official website address is much harder for a scammer to imitate, concluded Neumann.
Technical details
This action was brought by law enforcement, which is the body to watch for further updates.
The sign-up prompt asked for contact details and social media credentials.
Her advice is to steer clear of entering credentials after following an unsolicited link, Attackers copy photos and descriptions from legitimate properties, so judging a site by its looks gets hard.
Response
Rental phishing is now dealing with an active legal process, with the agency involved leading the action.
The chat responded directly to the visitor’s concerns and presented the card request as a routine security check.
What security teams should do
If your environment shows any indicators associated with Rental phishing, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.
Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.