Booking a trip this summer? That Booking.com login might be a fake

You found the hotel. The price is good. You click the link, the Booking.com sign-in page loads exactly as you remember it, and you type in your email, your password, and your card. Everything looked right. That's the problem: the page was a fake, and the address bar said booking-cn.com, not booking.com.

Why summer is scam season

When millions of people start booking flights and hotels at once, scammers follow the money. And the numbers this year are not subtle.

Security researchers at Check Point found that in May 2026 alone, 47,318 new travel-related domains were registered, up 33% from April and 19% higher than the same month a year earlier. Of those brand-new travel domains, 1 in every 112 was already classified as malicious or suspicious. Not eventually. Already, in the same month they were registered.

Zoom out and the trend is worse. Attacks on the hospitality, travel, and recreation sector have climbed 122% over three years, from an average of 1,032 weekly attacks per organization in May 2023 to 2,291 by 2026. Travel is now a favorite target, and summer is the peak.

What the fake sites actually look like

These aren't crude, misspelled pages. Check Point's researchers documented real credential-harvesting sites that reproduce the genuine sign-in flow. The trick isn't in the design; it's in the address. A dash and a couple of extra letters are all it takes to turn a trusted brand into a domain the brand has nothing to do with.

Here are the specific lookalikes Check Point named in its 2026 research, so you know the shape of the thing:

The same research flagged fake presale schemes hiding behind flight-search lookalikes like skyscanners[.]shop and skyscanners[.]life, where an added s and an unusual ending do the work. (We write the dots in brackets like [.] so your browser doesn't turn these into live links; never visit them.)

Why a dash is enough to fool you

Your eye reads booking-cn.com and sees the word "booking." That's the whole con. A dash feels official, like a regional edition of a site you already trust. But to every computer on the internet, booking-cn.com is a completely separate address from booking.com, owned by whoever registered it.

The genuine brands do use other endings for regional sites, which is exactly what makes the fakes plausible. The difference is that a real regional Booking.com address is still built on the brand's actual domain, not a look-alike word with a dash and a country code stapled to the front of .com. The only reliable way to tell them apart is to read the address slowly, right to left, before you type anything.

This isn't new, and it isn't slowing down

Last summer told the same story. Check Point's 2025 travel-season research counted over 39,000 new vacation-related domains in May 2025, with 1 in 21 flagged malicious or suspicious, a 55% year-over-year rise. Hospitality-sector attacks that month hit 1,834 per organization weekly. That report named Booking.com lookalikes too, including a fake reCAPTCHA page aimed at property owners and an Airbnb payment-page impersonator.

The pattern repeats every travel season: a flood of fresh domains, a slice of them already dangerous, the biggest names copied first. If you book trips online, this comes with the territory now.

How to check a travel link by hand

1. Don't click the link in the email or ad. Copy the address instead (long-press or right-click → "Copy link"), so you can read where it actually goes before you go there.
2. Read the domain from the right. Find the last piece before the first single slash. For a real site that's booking.com or airbnb.com, plain and simple. Anything like booking-cn.com or booking.com-deals.info is a different address wearing the name.
3. Watch for dashes and tacked-on words. booking-hk, airbnb-ca, skyscanners: a dash, an extra letter, or a region code bolted onto a trusted name is one of the most common patterns in this year's travel-scam research.
4. When in doubt, don't follow the link at all. Type booking.com or airbnb.com into your browser yourself, or use the official app, and find the deal there.
5. Or paste the domain into IP Tracker and let it run the comparison for you in seconds.

How IP Tracker helps

IP Tracker is a free Chrome extension. Paste a domain or a full email address into the popup; the free tier gives you 25 checks a day, with no account and no tracking. Only the value you paste is looked up.

For travel lookalikes, it does the boring version of the check above, every time. It compares what you paste against the official domains of more than 120 widely impersonated brands, and it flags near-miss spellings, dashes, and extra words that dress a fake domain up as a trusted one. A domain that exactly matches a brand's official address gets a "verified" note; a close-but-not-real match is flagged as a possible lookalike so you slow down before typing.

Around that, it shows whether Google Safe Browsing (Google's list of reported dangerous sites) has flagged the domain, how many security vendors flag it on VirusTotal, community abuse reports, and the domain's creation date. Since so many travel scams run on domains registered days earlier, a brand-new registration date is a useful supporting clue: if the banner says a "book your dream villa" site was registered a week ago, that's worth pausing over.

What can't it do?

Honesty matters more than comfort here, so four limits worth knowing:

• The brand list is about 120 brands. The most impersonated ones, not every travel site on earth. A lookalike of a smaller regional hotel chain or a niche booking service may not be on it.
• A fresh registration date isn't proof of anything. Legitimate new businesses register new domains every day. It's a clue that raises a question, not an answer.
• Blocklists lag. Google Safe Browsing is strong on known-bad sites, but a phishing domain registered this morning may not be reported and listed yet. That's exactly the window scammers exploit.
• It can't see the page you'd land on. IP Tracker checks the domain, not the contents of the site. A convincing copy of the Booking.com login still lives at the wrong address, so read the address first.

The best deal in the world isn't worth your login and your card number. When a travel offer arrives with a countdown timer and a link, slow down and read the domain character by character, or get a second opinion that does.

To summarize:

• ✓ Don't click links in travel emails and ads; copy the address and read it first.
• ✓ Read the domain from the right; watch for dashes and tacked-on words like -cn or -ca.
• ✓ When unsure, type booking.com or airbnb.com yourself or use the official app.
• ✓ Or paste the domain into IP Tracker and let it name the trick for you.

Have a safe, well-booked summer. 😎