Travel is the one industry where an unexpected message about a payment, a change of plan or a document you must confirm is not suspicious — it is Tuesday. That is the whole reason booking, loyalty and re-confirmation lures work as well as they do. This page is about wiring a DNS-verified list of currently-live phishing hostnames into the places a hotel group, an OTA, an airline or a tour operator can actually reach.
Every other industry tells customers to be suspicious of unexpected mail about payments and documents. Travel spent thirty years teaching them the opposite.
Think about what a legitimate trip actually generates. A booking confirmation from an aggregator, a separate confirmation from the property, a payment receipt from a processor with a descriptor nobody recognises, a pre-authorisation notice, a schedule change from the airline, a seat-selection prompt, a check-in reminder twenty-four hours out, a request to upload passport details for an advance passenger information requirement, a loyalty statement, a post-stay survey and an invoice. Ten or twelve separate senders, several of which the traveller has never heard of, arriving over weeks, most containing a link that expects to be clicked, several asking for identity documents or card details as a completely routine step.
"Treat unexpected requests for payment or documents with suspicion" is functionally unusable for someone travelling next Thursday, because unexpected requests for payment and documents are exactly what next Thursday looks like. The attacker does not need to be clever — only to insert one more message into a stream already carrying a dozen legitimate ones.
A global hotel group may genuinely send mail from the group domain, a regional marketing domain, a loyalty domain, a reservations platform domain and the property's own domain. No guest can be expected to know which of those is real, so "the sender looks unfamiliar" carries no signal at all.
Channel managers, property management systems, payment gateways, ground handlers and destination management companies all send mail on somebody's behalf. A domain the traveller has never seen is frequently entirely genuine, which destroys the last heuristic an ordinary person has.
Most phishing has to invent a deadline. Travel phishing does not: a departure date is real, an expiring rate is a genuine commercial mechanic, and a guest whose reservation appears at risk while standing in an airport is under authentic stress rather than manufactured pressure.
An OTA's exposure is in user-submitted content. A hotel group's is at property level. An airline's is in loyalty. A tour operator's is in payment. The list is the same; the placement is not.
Property descriptions, host profiles, guest messaging, review responses and supplier-supplied content all carry outbound links, and all of them are written by somebody other than you. The attack does not need to compromise anything: it needs a field that accepts a URL and a page that renders it.
Corporate security is usually competent and usually stops at the corporate network boundary. The property is a different world: a shared workstation behind the desk, a property management system login several people know, a duty manager's mailbox receiving channel notifications, and a general manager who is not an IT professional and should not have to be.
Points and miles have a resale market, a transfer mechanism and, in most programmes, weaker step-up authentication than the payment card sitting in the same account. A balance can be moved to a partner programme or spent on a redemption before the member notices, and recovery is a manual goodwill process rather than a chargeback.
Operators settle with local suppliers — transfers, guides, hotels, excursion providers — often in countries where the whole relationship is a long email thread and a bank account. That is a payment-diversion target of exactly the shape that hits freight and construction, and the lure arrives as a supplier updating their remittance details.
The most productive travel lure is not the too-good-to-be-true holiday deal. It is a boring administrative message about a booking that genuinely exists.
The version that works best begins with information the attacker should not have but frequently does: a real reservation reference, a real property name, a real date. That information leaks in several ordinary ways — a compromised mailbox at a supplier, a property management system account with a reused password, a channel manager login harvested months earlier, or simply a guest whose own email account is already being read by somebody else. Once the attacker has the booking, the message writes itself, because it only has to describe something true and then ask for one small action.
Two properties do the work in this industry: the verification standard that keeps the list live, and the delivery model that lets a property with no IT staff use it.
Every domain in the database has been confirmed to have an active A record, checked through rotating proxy infrastructure. Hosts that stop resolving drop out instead of accumulating. That is why the active figure sits above 390,000 rather than climbing forever, and it matters more in travel than in most sectors because seasonal campaigns are disposable by design — a set of hostnames stood up for a school-holiday booking wave and abandoned six weeks later is exactly the kind of infrastructure a report-everything archive would still be carrying in March.
The changelog is what makes a daily update survivable. The rebuild lands at 04:30 UTC with a list of what was added and removed. For an estate of properties that is the difference between a full-file replacement — which will eventually collide with somebody's maintenance window on a peak arrivals day — and a small diff applied in seconds. For a platform team it is the difference between reloading a lookup structure and updating one.
Delivery is where the sector splits. A booking platform or an airline with real engineering runs the /feed endpoint, holds the list in memory and matches locally, because per-request calls at booking volume would be absurd and the rate limit of ten requests per second per key says so plainly. A property, a small operator or a finance team runs /check and /batch, where a hundred hostnames go in one POST at one lookup each and the response returns checked, phishing_found and credits_used. Most groups do both.
A resolver change covers the back-office terminal, the kiosk, the business-centre machine and the staff Wi-Fi at once. Nothing has to be installed on hardware a franchisee owns.
Because matching happens against a local copy, no record of what a guest resolved on your Wi-Fi is sent anywhere. That is a straightforward line to put in a privacy notice.
A resort on a satellite or congested link still gets full protection, because there is no verdict service to be unreachable at the moment the connection is at its worst.
The property is where most of this industry's actual compromises happen, and it is the environment with the least applicable security architecture.
Almost every control recommended to hospitality assumes something the property does not have. Per-user identity assumes staff have individual accounts rather than a shift login three people know. Endpoint protection assumes a managed device estate rather than a terminal that arrived with the property management system and has not been touched since installation. Conditional access assumes a directory. Awareness training assumes a workforce that will still be there next quarter, in a sector where seasonal and agency staffing is normal and where the person on the desk tonight may have started on Monday.
Each one is a specific hook in a system you already run, and each answers a question that would otherwise be left to somebody's judgement.
Extract hostnames from every field where a supplier, host, property or guest can put a URL — descriptions, profiles, review replies, message attachments, supplier-supplied media — and batch them before the content is published. A confirmed match holds the item for review rather than silently deleting it, which keeps the appeal path honest.
The extranet, channel-manager and payout-verification lures land in a small number of well-known mailboxes. Screening hostnames extracted from inbound links at the gateway, or from the message store after delivery, gives a verified verdict on the ones already known.
For operators and DMCs settling with ground suppliers, the payment job batches hostnames from the correspondence trail and holds the run on a confirmed match. It is one call and one hold condition, and it lives in the workflow rather than in a security tool nobody opens.
Destination guides, partner directories and long-lived marketing pages accumulate outbound links for years, and domains lapse and get re-registered by somebody else. A quarterly sweep of every outbound hostname in the content management system costs a trivial number of credits.
The four integrations above each cover one path. The resolver covers every device on the site at once, including the ones nobody has an inventory of: the kiosk, the signage box, the back-office terminal, the shift phone and the guest handset that joined the Wi-Fi four minutes ago. It requires no agent, no per-device configuration and no cooperation from a franchisee beyond pointing at the right resolver address.
Two spending shapes, and one limitation that belongs in the main text rather than in a footnote.
Workflow integration runs on credits — monthly subscription, billed monthly from purchasefewer than ten percent have been used. The volumes are small for the jobs described above: a quarterly content sweep, a payment-release check, a reservations-mailbox screen. the Growth plan is $99/month for 25,000 lookups at $0.0040 per lookup, $99 Growth is 25,000 , and $249 Professional is 100,000 . A single operator doing periodic audit work will often find the smallest package lasts a year or more.
An OTA screening every user-supplied field on every listing edit generates lookups continuously, and the rate limit of ten requests per second per key exists to tell you when you have outgrown the API. The Daily Threat Feed is $499 per month — the annual option saving $1,989, a third off — and adds historical archive access, priority support, custom format options, a dedicated account manager and 100,000 API credits, which covers the periodic workflow jobs without a second purchase.
Downloads are unlimited, so a group with two properties and a group with four hundred pay exactly the same. That is what makes the feed the right answer for a hotel group and the wrong answer for a single independent property — and why, if you are the brand in a franchise relationship, extending resolver coverage to a property is a configuration line rather than another subscription, and one of the few security things a brand can do for a franchisee instead of requiring of them.
Monthly plans range from Business at $499/month for 250,000 lookups, $999/month for 750,000 lookups, Enterprise at $999/month for 750,000 lookups and Enterprise at $999/month for 750,000 lookups per lookup. SFTP or S3 delivery, STIX/TAXII, a custom update frequency, an SLA or on-premise deployment are quoted rather than listed. The complete table is on the pricing page and endpoint detail in the API documentation.
This is a known-bad lookup. A confirmed match means a hostname has been observed, verified as resolving and confirmed as phishing infrastructure; a clean result means "not on the list", which is not the same as safe. A domain registered this morning and first used this afternoon will not be there yet, it will not tell you a holiday-rental listing is a scam, it will not evaluate whether a supplier is real, and it does not watch registrations for new look-alikes of your brand.
These come up in almost every conversation with a hotel group, platform or operator, and several deserve an answer less flattering than a brochure would give.
Only if they are already in the database — and importantly, this is a lookup service, not a brand-monitoring product. It will not watch registrations and alert you when something new appears that resembles your name.
Responses are under 50 milliseconds, so a single check is not what will make a booking flow slow. The real constraint is the rate limit of ten requests per second per API key, which at booking volume you will exceed quickly.
This is exactly why the resolver placement is the recommended one for hotel groups. You are not installing anything on a franchisee's hardware, not touching their property management system, and not asking for administrative access to anything they own. You are providing a resolver address for them to point at, which is the kind of change that fits inside a normal brand-standards conversation.
The feed model is unusually strong here and worth stating explicitly in your privacy notice. You download the list once a day; every subsequent comparison happens on your own equipment. No record of what a guest looked up is sent to anybody, because there is no per-query call to send. The only outbound traffic is your authenticated daily download, which reveals nothing about any guest.
Have the answer ready before it happens. Keep a local allow-list that your reload script applies after each daily import, so an override survives the next update instead of needing to be re-applied every morning. Give the front desk a documented two-minute route to request an addition, and make sure the block page tells the guest a person can help.
It helps with the harvesting step, which is where most loyalty compromise begins. Members are phished with expiry warnings, tier reviews and bonus offers pointing at copied login pages, and those hostnames are exactly the kind of infrastructure this database is built from.
The database is rebuilt every 24 hours with the build landing at 04:30 UTC, and every domain is DNS-verified through rotating proxy infrastructure so only hosts with an active A record are included. Entries that stop resolving fall out rather than accumulating, which is why the active count stays around 390,000 rather than growing without limit.
is_phishing, a category of phishing/malware, a dns_status of resolves, a last_checked date and a confidence of 0.98 for a confirmed match or 0.0 for no match. There is no intermediate score, which makes automated handling straightforward — hold or pass, with no threshold to tune.The feed probably is not, and it would be unhelpful to suggest otherwise — $499 a month against a single property's technology budget is not proportionate, and you would need somebody to run the daily pull.
Screen submitted content, reservations mailboxes and supplier payments with a monthly plan, or run the daily feed on the resolvers behind your properties, your guest Wi-Fi and your booking platform.
