airbnb-nextjs-ammar-ahmads-projects[.]vercel[.]app

Analysis of airbnb-nextjs-ammar-ahmads-projects.vercel.app shows a newly created domain (registered on February 21, 2026) that resolves to the Amazon Web Services address 64.29.17.195, an IP owned by AS16509 Amazon.com, Inc. The domain was registered through Tucows Domains Inc. and is protected by an SSL certificate issued by Google Trust Services under the WR1 authority, indicating a valid HTTPS endpoint. HTTP probing returns status code 451 and the page title "Deployment Unavailable," a generic response generated by the Vercel hosting platform, which also reports the presence of HSTS. VirusTotal scans have flagged the domain by 13 of 93 security vendors, and the site appears on a single security blocklist.

PhishDestroy has actively blocked the domain, and the current operational status is offline. The intelligence categorizes the activity as a crypto scam, consistent with the "generic phishing" threat type and an elevated risk rating. While the offline status prevents direct observation of malicious payloads or credential‑stealing pages, the combination of a fresh registration, AWS hosting, SSL from a trusted authority, and multiple vendor detections supports a high confidence assessment of malicious intent.

Defenders should add the domain to blocklists, monitor the associated IP range for related activity, and consider issuing alerts for any future resolution to the same IP address. Continuous re‑evaluation is advised should the site become reachable again, as the current evidence suggests a deliberately concealed phishing infrastructure targeting cryptocurrency users.