A threat-intelligence report published November 6 describes an active phishing operation that impersonates a short-term lodging and experiences marketplace, while adding detection coverage for the traffic pattern it observed. The report says the sites copy legitimate property listings, use lookalike domains and pressure travelers with unconfirmed reservations or payment warnings before collecting passwords, personal details and card data (Threadlinqs threat report).
The distinctive feature is a live chat function used to answer hesitant visitors. Help Net Security, reporting on Fortra’s Intelligence and Research Experts (FIRE) findings, says the chat reassured visitors that a card form was a routine security check and that no charge would be made. The same reporting describes a staged flow involving copied property photos and descriptions, a fake sign-in page, a verification form and a payment screen (Help Net Security report).
Threadlinqs’ published free detection identifies HTTP POST activity to booking-themed lookalike hosts, including the reported rooms-home93914.space indicator. It provides versions for Splunk, Microsoft KQL and Sigma and maps the activity to credential-phishing and financial-theft techniques. That means the method is aimed at spotting data submission rather than merely identifying that a user visited a suspicious page.
The evidence does not establish that every matching request is malicious. The Sigma rule is marked experimental, the report assigns medium confidence to the overall detection, and its own tuning notes list legitimate services, corporate travel tools and partner applications as possible false positives. The report recommends extending the listed top-level domains to match an organization’s environment and allowing known-good hosts, but those conditions imply operational tuning before deployment.
The practical distinction is therefore between campaign-specific coverage and a general phishing defense. The observed domain and naming patterns may help organizations investigate this reported campaign, while the copied-listing and live-chat techniques described by FIRE show why URL and host-based signals alone may need contextual review. Neither document provides evidence of a measured detection rate or production validation.