DNSFilter Research Shows Huge Spike in Fake Travel Sites Ahead of Summer Vacation Season

Protective DNS leader advises caution for travel planners
with data on vacation-related traffic spikes

WASHINGTON, D.C. – May 8, 2025 – New data collected by DNSFilter from its DNS content filtering and threat blocking platform underscores the fraud risks that consumers face when researching summer vacation plans. Bad actors are always looking to capitalize on the latest trends and upcoming events to try to lure people into taking actions like clicking phishing links, and with the busy travel season approaching, they’re already in full swing. 

DNSFilter’s research team found that between January and March, bad actors were already using terms like “vacation,” “travel,” and “all-inclusive” to entrap unsuspecting users looking for vacation deals, tips and offers. In general, traffic on the DNSFilter network to travel sites ramps up every year between January and May, and with that comes the attempted scams. 

Data gathered from DNSFilter’s platform revealed the following key insights:

• Traffic to threat sites that include the word “travel” spike between May and June each year:  Traffic peaked on May 8, 2024, marking 256% over the average between 2023 to April 2025. 
  
  
• “Vacation” domains are blocked more often in the summer: June 12, 2024 saw 3.46% of all traffic to domains with “vacation” in their name blocked (the highest-ever percentage); as of March 2025, this type of domain is being blocked more frequently as we head into summer.

• April heated up for bad actors: In 2025, the largest spike in traffic to threat sites with travel terms in their name was on April 28, marking a 116% increase over the average since 2023. 

• Traffic to malicious sites with “travel” in the domain name was 235% higher between May and July 2024 than the overall average between 2023 and April 2025.
  
  
• Airline and location names are regularly used by fraudsters: Common terms used in malicious sites purporting to be legitimate travel sites include “Delta,” “Spirit,” “beach,” “package,” and “tour;” the top-trafficked vacation scam sites include the word “Mexico.” 

With summer around the corner, DNSFilter expects to see traffic to malicious sites using travel and vacation terms increase. Consumers need to remember to look carefully at any site offering deals that sound too good to be true, and spelling errors can be a dead giveaway. (We noticed one domain using “daels” instead of “deals.”) Stick with trusted, legitimate travel sites and if a link seems suspicious, don’t click on it. Double-check your existing filtering policies and make sure you’re blocking new domains, phishing, malware, and deceptive sites to protect your end users.

Ken Carnesi, CEO and co-founder, DNSFilter, said: “This is the time of year that people start making summer travel plans and unfortunately it’s also when bad actors try to rip them off. Our threat filtering platform identifies and blocks access to unwanted or malicious sites by finding and categorizing threats and harmful sites before a connection is made. We will continue to educate and defend our customers, creating a more secure online experience both before peak travel season and throughout the year.”

About the company:

DNSFilter is making the Internet safer and workplaces more productive by blocking malicious and unwanted content at the DNS layer. DNSFilter resolves upwards of 170 billion daily queries—200 million of those queries are blocked cyber threats. With 79% of attacks using Domain Name System (DNS), DNSFilter provides the world's fastest protective DNS powered by AI, blocking threats an average of 10 days faster than traditional threat feeds. Over 40,000 organizations trust DNSFilter to protect them from advanced cyber threats and unwanted content.

Media Contact

Shannon Van Every

Force4 Technology Communications

Shannon@force4.co