airbnb-seven-lime[.]vercel[.]app

The domain airbnb-seven-lime.vercel.app is actively hosting a brand‑impersonation campaign targeting Airbnb. The site returns HTTP 200 and presents the page title "AirBnB," matching the advertised brand target. Infrastructure analysis shows the domain resolves to IP 64.29.17.3, an address owned by Amazon.com, Inc. (AS16509) in the United States. The domain uses a legitimate SSL certificate issued by Google Trust Services (WR1), and its DNS is served by four Vercel‑provided name servers (ns1‑ns4.vercel-dns-3.com). Technical fingerprints indicate the presence of Vercel hosting, a React front‑end, and HTTP Strict Transport Security (HSTS). The site was registered through Vercel Inc. on 28 January 2020 and is currently flagged by two external blocklists (PhishDestroy, PhishingDB). Reputation services assign a Gridinsoft score of 0 / 100 and a Scamadviser score of 1 / 100, reflecting extreme untrustworthiness. VirusTotal scans show 19 of 93 security engines flag the domain, reinforcing malicious intent. The campaign is identified as using the "Airdrop Scam" phishing kit, a known module for credential harvesting. Defenders should immediately block the domain and its resolving IP at network perimeter devices, add the domain to internal URL filtering lists, and monitor for other subdomains hosted on the same Vercel name‑server set. Given the legitimate certificate and common hosting platform, traditional certificate‑based controls may not be sufficient; behavioural detection of credential submission to the domain is recommended. Continuous threat‑intel feeds should be consulted for any emerging variants that reuse the same hosting infrastructure.