airbnb-cloneuv6y[.]rollout[.]site

This domain, airbnb-cloneuv6y.rollout.site, is flagged as a credential harvesting phishing site impersonating Airbnb's vacation rental platform. The page title, "Airbnb Clone - Vacation Rentals," and infrastructure analysis indicate an attempt to deceive users into submitting login credentials or payment details under false pretenses. No specific drainer kit signatures were identified, but the generic phishing classification suggests a broad targeting mechanism rather than a specialized payload. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026, and resolves to IP address 37.72.169.170, hosted on AS29802 (HIVELOCITY, Inc.) in the United States. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing status remains unconfirmed. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by SSL2BUY EMEA LLC under the RSA Domain Validation Secure Server CA, a common provider for both legitimate and malicious sites. As of the latest verification, the domain has been taken offline, likely due to hosting provider intervention or registrar enforcement. While the immediate threat is mitigated, the infrastructure (IP, registrar, and SSL issuer) may still pose residual risk. Organizations should monitor for re-registration under similar naming conventions or reuse of the hosting IP for other phishing campaigns. Network defenders are advised to block the domain and IP at perimeter controls and alert users to verify Airbnb-related communications through official channels only.