Is booking.com a scam?

Our automated security review found no threat indicators on booking.com. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.

Is booking.com safe to use?

booking.com passed our automated security checks with a trust score of 93/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.

Does booking.com have a valid SSL certificate?

Yes. booking.com presents a valid TLSv1.3 certificate issued by DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1, expiring in 129 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.

How old is the booking.com domain?

booking.com is 28.2 years old, registered on 4/17/1998 through MarkMonitor Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.

Has booking.com been flagged by antivirus engines?

No. All 92 antivirus engines in our malware network report booking.com as clean.

Is booking.com on any phishing or malware blacklists?

No. booking.com is not currently listed on the major browser blocklist feeds that modern browsers use.

Where is booking.com hosted?

booking.com resolves to an IP operated by Amazon.com, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.

Is booking.com a well-known website?

Yes. booking.com sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.

Security Review

Is booking.com legit or a scam?

Our verdict:Safe· 93/100

SafeSuspiciousDangerous

Booking.com is a legitimate global travel agency with a 28-year-old domain, though users should remain alert for phishing emails impersonating the brand.

Why we trust it

Domain age exceeds 28 years with a transparent ownership history.Official business registration verified with the Amsterdam Chamber of Commerce.Zero detections across our entire antivirus network and malware engines.

booking.comScanned 2h ago

Post Facebook

Trust score

SAFE

Heuristics 94·MT 92

Warning signals (1)

Redirects to another domain

Positive signals (5)

Antivirus clear Not on major blacklists Domain is 28 years old Encrypted connection Clean server reputation

View density

Analysis Summary

Threat Intelligence

0/92

All engines report clean

Domain Age

28 years old

Registered Apr 17, 1998

MT Intelligence

Safe

Low likelihood · 95% confidence

SAFE

No threats detected

All checks passed. This site appears legitimate — but always stay alert for phishing even on trusted domains.

Website Preview

LIVE RENDER

booking.com

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site.

MT Intelligence

Advanced threat intelligence

MT Security Analyst

Low scam likelihoodengineMT · Guardiantrust92/100

MT AgentLive web researchVisual inspection

Confidence

The domain has been registered since 1998 and is operated by Booking.com B.V. in the Netherlands. Our analysis confirms it is the official primary domain for the brand, not a clone or impersonator. Technical signals are excellent, with a valid high-assurance SSL certificate and a top-tier global traffic ranking. Although there are numerous consumer complaints regarding customer service and reports of external phishing scams targeting its users, these are typical for a platform of this scale. The infrastructure itself is secure and verified.

Full dossier

Analysis complete

Page Content

The page is a high-performance web application that serves as a global hub for travel reservations. It utilizes modern JavaScript frameworks to handle real-time pricing and availability across millions of listings.

Infrastructure

The site is hosted on high-reputation enterprise servers with no history of abuse. It uses a valid DigiCert SSL certificate and maintains a massive global traffic footprint, ranking among the most visited sites on the internet.

Domain History

Registered over 10,000 days ago in 1998, the domain has a continuous and transparent ownership history. It is registered to the official corporate entity in Amsterdam and is part of a major publicly traded travel group.

Web Reputation

While the site has a high volume of negative feedback on independent review aggregators, this is largely due to the scale of its operations and disputes over refunds or hotel quality. Major news outlets have reported on 'reservation hijack' scams, but these involve attackers compromising individual hotel accounts rather than a breach of the booking.com domain itself.

Risk Factors

High volume of consumer complaints regarding refund disputes and customer service.
Frequent target for phishing campaigns where attackers impersonate the brand via email and WhatsApp.
Reports of 'reservation hijacking' scams involving compromised third-party hotel partners.

Positive Signals

Domain age exceeds 28 years with a transparent ownership history.
Official business registration verified with the Amsterdam Chamber of Commerce.
Zero detections across our entire antivirus network and malware engines.
Top-tier global traffic ranking and enterprise-grade security infrastructure.

AI Recommendation

You can safely use this website for travel bookings. Always ensure you are on the official booking.com domain and never provide payment details via WhatsApp or external email links.

Next-gen fraud intelligence

Evidence-backedCross-checked

Web Research Findings

Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for booking.com, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.

Domain age

28 yrs

Registered Apr 1998

Business registration

Active · Netherlands

Site traces back to an actively registered business.

Clone check

Not a clone

No well-known site's layout or branding detected here.

Typosquat check

No look-alike match

The domain doesn't resemble any well-known brand's spelling.

Web mentions

5 scam reports · 120000 complaints · 1 positive

Key findings

7 headline facts from open-web research

Domain registered in 1998 (over 28 years old) to Booking.com B.V. in the Netherlands.
Official company: Booking.com B.V. (Chamber of Commerce 31047344, Amsterdam); part of Booking Holdings.
Trustpilot rating 1.6/5 from ~120,000 reviews; majority cite poor customer service, refund issues, and cancellations.
Multiple reports of "reservation hijacking" scams following a 2026 data breach that exposed customer names, emails, phones, and booking details.
Common scams include phishing via fake Booking.com messages/emails/WhatsApp requesting payments or card details outside the platform; Booking.com warns users against this.
BBC, Fox News, Guardian, Reddit, and ABC News have covered ongoing scams targeting Booking.com users, often involving compromised hotel accounts or data from breaches.
Booking.com maintains a dedicated trust and safety page advising users on recognizing and avoiding scams.

Scam reports (5)

Direct quotes from public scam databases, forums, and news.

BBCopen
"A data breach at travel giant Booking.com is leading to a fresh wave of scams recently dubbed "reservation hijacks"."
Trustpilotopen
"Scammed by Booking.com! We reserved a large house... It’s been two years... we don’t have our promised money."
Redditopen
"Booking.com host scam - I lost $3,100, Booking customer service literally told me the wire was fine before I sent it"
Fox Newsopen
"Booking.com data breach exposes traveler data to scams"
The Guardianopen
"Booking.com customers targeted by scam ‘confirmation’ emails"

Positive reviews (1)

Quotes indicating the site is legitimate.

Redditopen
"I've been using it for years with no issues. It's legit."

Business registration

Status: active · Netherlands

Booking.com B.V. registered with Amsterdam Chamber of Commerce under number 31047344; VAT NL805734958B01; subsidiary of Booking Holdings Inc. (NASDAQ: BKNG); UK entity BOOKING.COM LIMITED (03512889) active since 1998

Research summary

Narrative write-up from our AI analyst, grounded on the facts above

Our research confirms that Booking.com B.V. is a legally registered entity in the Netherlands. While we found over 120,000 complaints on independent review sites, these primarily concern service issues rather than the site being a scam. Major news outlets like the BBC and The Guardian have documented sophisticated phishing attacks that target Booking.com customers, but these occur through external channels like email and compromised hotel portals, not the booking.com website itself.

Antivirus Engines

Clean pass · verified

Clean across 92 engines

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. None of them flagged this URL in the last scan.

0Malicious0Suspicious61Harmless92Engines

Clean

Kaspersky

Clean

Bitdefender

Clean

Microsoft

Not in pass

ESET-NOD32

Not in pass

Avira

Not in pass

Sophos

Clean

Fortinet

Clean

Google Safebrowsing

Clean

Emsisoft

Clean

No engine detections. The URL passed every antivirus and blacklist engine we queried in this scan. Stay vigilant — AV coverage is only one signal among many.

Security Scans

Blacklist Check

Not flagged on major threat lists

Checked against the major public blocklists used by browsers and security tools — no hits.

Contact Verification

We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.

What We Found

No clear contact details on the page

Emails on site's domainNone

Phone numbersNone

Postal addressNot listed

Linked social profiles0

Signal Summary

Several contact red flags

No contact email found anywhere on the page.
No phone number listed on the page.
No postal address visible on the page.

Domain & Encryption

Domain History

Age28 years old

RegistrarMarkMonitor Inc.

RegisteredApr 17, 1998

ExpiresApr 16, 2027

Owner privacyVisible

Encryption Certificate

StatusValid

ProtocolTLSv1.3

IssuerDigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1

ExpiresOct 30, 2026 (129d)

Self-signedNo

Hosting & Technology

HostingAmazon.com, Inc.

Server locationUS

Web servernginx

PopularityTop 100k worldwide

Redirect Chain

Hops

Cross-domain

Yes

Lookalike

Punycode

1301http://booking.com/
2301https://booking.com/
3202https://www.booking.com/cross-domain

Server Reputation

Abuse Intelligence

Confidence score0%

Reports on file0

ISPAmazon.com, Inc.

Usage typeContent Delivery Network

Still, stay alert

No major threat indicators — but a clean scan does not guarantee every page is safe, and phishing emails routinely spoof real domains.

Double-check the exact URL in your address bar
Confirm you are actually on booking.com and not a lookalike like b-ooking.com.com or an IDN homoglyph.
Use a password manager
Password managers only auto-fill on the exact domain they were saved for — they refuse to fill lookalike domains, which is the single best phishing defence.
Discuss this site on the forum
If you have first-hand experience with this site — good or bad — share it with the MalwareTips community.
Open

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing

Not listedCheck ↗

VirusTotal

Not listedCheck ↗

AbuseIPDB

Not listedCheck ↗

Also verify:Spamhaus ↗DNSBL / SURBL ↗PhishTank ↗

Safety FAQ

Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

Our automated security review found no threat indicators on booking.com. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.
booking.com passed our automated security checks with a trust score of 93/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.
Yes. booking.com presents a valid TLSv1.3 certificate issued by DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1, expiring in 129 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
booking.com is 28.2 years old, registered on 4/17/1998 through MarkMonitor Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
No. All 92 antivirus engines in our malware network report booking.com as clean.
No. booking.com is not currently listed on the major browser blocklist feeds that modern browsers use.
booking.com resolves to an IP operated by Amazon.com, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
Yes. booking.com sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.

Final Verdict

Trust / 100

Final Verdict·booking.com

SAFE

This is the official website for Booking.com, a legitimate and long-established global travel platform. While the company is a frequent target for third-party phishing attacks, the domain itself is authentic and safe to use.

You can safely use this website for travel bookings. Always ensure you are on the official booking.com domain and never provide payment details via WhatsApp or external email links.

AV engines

MT passes

Net signals

Scan another URL

Security review completemalwaretips.com/url-scan

Recently scanned

Other Safe reports

smgmedia.socialmediagirls.com

autowerkstatt-sperhake.de

Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…

Loading comments…

This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.