Planning a trip? Fake travel sites are multiplying this summer

Check Point reports a substantial surge in cyberattacks against hospitality, travel, and recreation organizations — averaging 2,291 incidents per organization per week in May 2026 — driven by mass domain registrations and coordinated phishing campaigns. Researchers identified 47,318 travel-related domains registered in May (many flagged malicious), three bulk-registration operations creating hundreds of hotel- and travel-themed domains, and phishing sites impersonating Booking.com, Airbnb, and Skyscanner to steal credentials and payment card information ahead of summer travel peaks.