next-ab-clone-apetta[.]vercel[.]app

The domain next-ab-clone-apetta.vercel.app was observed hosting a site whose HTML title reads “Airbnb Clone”, indicating a direct brand impersonation of Airbnb. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the IPv4 address 64.29.17.67, which is announced by Amazon.com, Inc. (AS16509) and geolocated to the United States. The hosting environment reports the presence of Vercel services and HTTP Strict Transport Security, while the TLS certificate is issued by Google Trust Services under the WR1 profile, confirming a valid HTTPS endpoint despite the malicious intent. An HTTP response code of 451 was returned, signalling that the content is unavailable for legal reasons, consistent with the site’s offline status at the time of analysis. Multiple defensive feeds have flagged the domain.

PhishDestroy has placed the site on its blocklist, and the domain appears on a single additional security blocklist. Google Safe Browsing categorises the URL as “social engineering”, confirming the phishing nature of the content. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of reputation. VirusTotal scanned the host and recorded 17 detections out of 93 scanned security vendors, reinforcing the malicious classification.

Given the convergence of brand‑specific page title, registrar information, IP attribution, TLS configuration, and the breadth of independent detections, analysts can conclude that the domain was actively used for an Airbnb‑targeted impersonation campaign before being taken offline. Defensive operators should continue to block the domain at network perimeters, update URL filtering lists, and monitor for any re‑registration attempts that reuse the same lexical components. Threat intelligence sharing with partners should reference the observed indicators: domain name, registration date, IP address 64.29.17.67, TLS certificate details, and the 17 VirusTotal detections.