airbnb-1869ae[.]webflow[.]io

This domain, airbnb-1869ae.webflow.io, is identified as a high-risk phishing site targeting users of the Airbnb platform. Analysis indicates the site mimics the legitimate Airbnb interface to deceive victims into submitting login credentials, payment details, or personal information. No specific drainer kit signatures were detected in initial scans, but the infrastructure aligns with common phishing toolkits leveraging cloud-based hosting and automated deployment frameworks. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. It is registered through MarkMonitor, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). The domain was originally created on May 8, 2013, though the phishing content appears to be a recent deployment. It appears on at least one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to malicious sites. As of the latest assessment, the domain has been taken offline, likely due to automated takedown mechanisms or hosting provider intervention. However, residual risk remains due to potential redirects, cloned infrastructure, or re-deployment under a different subdomain or top-level domain. Users who interacted with the site are advised to reset credentials immediately, monitor financial transactions for unauthorized activity, and verify the legitimacy of any communications claiming to originate from Airbnb. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.