How a hotel booking page gets cloned, step by step

Almost every hotel we speak to assumes that a fake booking page requires breaking into something. It does not. The attack never touches the hotel's infrastructure, which is exactly why the hotel's security tooling never sees it.

1. The copy

A single command mirrors the public site — markup, stylesheets, images, the lot. It takes a couple of minutes on a hotel brochure site and produces something that renders almost identically, because it is almost identical.

wget --mirror --page-requisites --convert-links https://yourhotel.com

Nothing about this is detectable from your side. It is one visitor fetching public pages, indistinguishable from a search engine or a person with a slow connection and a lot of tabs.

2. The domain

Something one character away from yours, or the same name under a different suffix. A hyphen inserted. The word 'booking' or 'reservations' bolted on. Registered with privacy protection for a few dollars, with a free certificate issued within minutes.

That certificate is the first moment the attack becomes visible to anyone, because every certificate issued is published to public certificate transparency logs. Watching those logs for names resembling yours is a real signal — but it is a weak one on its own, since a domain that resembles yours has done nothing wrong until it serves your site.

3. The booking form

The one part that gets rewritten. The real form posts to your booking engine; the copy posts to the attacker. Everything else stays untouched, because touching it risks breaking the illusion.

This is why the copy usually keeps your analytics, your fonts, and anything else you embedded. Removing things costs effort and gains nothing — the victim is not going to view source.

4. The traffic

A small search advertising budget against your own hotel name, or messages to people who have posted about visiting your city. It does not need volume. A dozen deposits at a few hundred each is a good week for this kind of operation, and it runs until someone notices.

Where it can be caught

There are exactly two moments, and both of them are outside your firewall.

• When the certificate is issued — visible in public transparency logs, usually days before the site is used. Weak on its own, because resemblance is not wrongdoing.
• When the copy is served to a real person — visible if the copied markup carries something that reports home. This is decisive, because the copy asking for your beacon means the copy was made from your page.

The second is what our clone detection does, and it is worth being precise about its limit: an attacker who strips the beacon out will not appear. Most do not, because the copying is automated and the value is in volume. It catches the common case cheaply. It does not catch a careful adversary, and any vendor telling you otherwise is selling you something.

If you find one

• Save the evidence first — the page as served, with a timestamp.
• Report to the registrar and the hosting provider, separately. They act on different timelines.
• Report the URL to Google Safe Browsing and Microsoft SmartScreen. Browser warnings kill the conversion rate faster than a takedown lands.
• Warn your own guests on your own channels before they are warned by a charge on their statement.