airbnb-clone-app[.]vercel[.]app

airbnb-clone-app.vercel.app was registered through Tucows Domains Inc. on February 21, 2026 and resolves to the Amazon-owned IP address 64.29.17.131, which is geographically located in the United States under AS16509 (Amazon.com, Inc.). The site presented the page title "Deployment Unavailable" and employed Vercel hosting with HSTS enabled, indicating a modern web stack but offering no legitimate content. Security telemetry shows the domain was flagged by ten of ninety-three VirusTotal scanners, a level of detection consistent with malicious activity, and it is listed on a single known blocklist, PhishDestroy.

The SSL certificate presented is issued by Google Trust Services under the WR1 identifier, a legitimate certificate authority, suggesting the operators obtained a valid certificate to increase credibility. HTTP responses returned a 451 status code, which denotes unavailable for legal reasons and often appears when a service is taken down or blocked, aligning with the current offline status reported. Intelligence classifies the campaign as a crypto scam, a subset of generic phishing, and the risk rating is elevated.

Defenders should immediately block the domain and its associated IP in inbound and outbound filtering policies, monitor for any re‑registration or re‑hosting of the same hostname, and consider adding the IP range of AS16509 to watchlists for potential reuse. Continuous observation of VirusTotal and other multi‑engine scanners is recommended to capture any changes in detection scores, and analysts should verify whether the PhishDestroy blocklist entry is updated with additional indicators such as URLs or payload samples. Given the legitimate certificate and modern hosting, threat actors may attempt to resurrect the site, so periodic re‑evaluation of the domain's DNS resolution and TLS fingerprint is advisable.