booking-clone-sigma[.]vercel[.]app

Analysis classifies this domain as High risk and identifies the threat type as brand_impersonation. The hosted content presents a cloned booking-themed interface and uses the page title "Booking.com clone," indicating an attempt to mimic a legitimate service and potentially capture user credentials, payment details, or other sensitive information. Intelligence sources further indicate that the site remains active and is currently associated with phishing-related detections.

Infrastructure review shows the domain booking-clone-sigma.vercel.app is registered through Vercel Inc. and resolves to IP address 198.18.2.76. The IP is geolocated in the US and associated with AS16509 Amazon.com, Inc. Security telemetry reports that 22 out of 95 security vendors flag the domain. The domain appears on 2 security blocklists and is specifically blocked by PhishDestroy and PhishingDB. External reputation data indicates that Google Safe Browsing flags the domain for phishing. Certificate analysis identifies an SSL certificate issued by Google Trust Services / WR1. The target being impersonated is Booking, and the current operational status is still active. No creation date information was provided in the available intelligence.

Recommended mitigation includes immediate blocking of the domain and associated indicators across network, DNS, proxy, email, and endpoint controls. Users should avoid entering credentials, payment information, or personal data on the site. Organizations should monitor authentication logs for signs of credential reuse following exposure, review web-filtering policies, and investigate any connections to the resolved IP address. Security teams should maintain detection coverage for brand impersonation campaigns, monitor for infrastructure changes, and validate that blocklist and reputation-based protections are updated to reflect the current active status of this threat.