airbnb-rooms[.]netlify[.]app

This domain is flagged as a high-risk credential harvesting phishing site targeting users of a popular short-term lodging platform. Analysis indicates the site is designed to deceive visitors into submitting login credentials, payment details, or personal information under the guise of legitimate service interactions. The threat type is classified as generic_phishing with a focus on brand impersonation and financial fraud. Infrastructure analysis reveals the domain airbnb-rooms.netlify.app was registered through Netlify on May 09, 2018, and currently resolves to IP address 98.84.224.111, hosted on AS14618 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), a common certificate authority exploited in phishing campaigns to lend false legitimacy. The page title, "Aluguéis por Temporada, Acomodações, Experiências e Lugares - Airbnb," precisely matches the legitimate platform’s branding, increasing the likelihood of successful deception. The domain appears on one security blocklist and is flagged as phishing by Google Safe Browsing. VirusTotal reports 17 out of 95 security vendors have detected malicious activity associated with this domain. Mitigation steps for organizations and users include immediate blocking of the domain and its resolving IP (98.84.224.111) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection, email filtering, and web gateway solutions to prevent access. User awareness training should emphasize verifying domain authenticity, particularly for platforms handling financial transactions. Monitoring for similar Netlify-hosted subdomains mimicking trusted brands is recommended, as this infrastructure is frequently abused for phishing. Incident response protocols should include credential reset procedures for any accounts potentially exposed to this domain.