Is hotelbox.cc safe?

A real Austrian company behind a voucher product customers struggle to use

The site is not anonymous. Its terms name AWARDIT Marketing GmbH, Dr. Schauer Straße 26, 4600 Wels, Austria, and the page lists a domain-specific contact email (office@hotelbox.cc), a phone number (+43 7242 20256060) and a postal address. That is a genuine operating entity, which is why this is not scored as a fake shop or a phishing page.

The commercial model is a straightforward voucher transaction: the site shows a shopping cart for buying hotel and travel vouchers, and redemption is routed to an external platform, Connexservice, while corporate services point to Awardit-solutions. Those cross-domain handoffs are normal for a voucher issuer, but they mean the actual booking experience happens away from hotelbox.cc and is governed by partner-hotel terms the buyer does not see at checkout.

Review evidence points to redemption friction and unexpected extra charges

Independent review evidence is strongly adverse. One an independent review platform summary cited in the research shows a 51% one-star share for hotelbox.cc, which is a heavy concentration of dissatisfied buyers rather than isolated grumbling.

The substance of those complaints is specific. One customer reports that despite holding a voucher, the hotel additionally billed an unused wellness area, a 'Nächtigungs-/Kur-/Müllabgabe', an 'obligatorische Abgabe' and a 'Kategorieaufschlag' — mandatory local levies and category surcharges layered on top of the voucher value. Another reports holding a Hotelbox voucher for two and a half years and never being able to book their desired travel period at various hotels.

Taken together, the pattern is a voucher whose advertised value is undermined by availability restrictions and fees disclosed only at the hotel, not at purchase. That is the core commercial-deception concern here, and it is why the score sits in the moderate-risk band rather than Safe.

Clean technical checks do not offset the redemption complaints

On the technical side there is nothing to flag: the browser threat feed returned no threat warning, the saved TLS check found a valid encrypted connection, and the registrable domain is over 6,300 days old, consistent with a long-established business rather than a throwaway scam domain.

One saved antivirus observation records a single engine family (Forcepoint ThreatSeeker) reporting an adverse result, but that report is stale and partial, so it is weak corroboration rather than a current malware finding. It does not change the picture: the risk here is commercial and contractual, not malicious code.