airbnb-clone-final[.]vercel[.]app

This domain, airbnb-clone-final.vercel.app, is flagged as an active brand impersonation threat targeting Airbnb. Analysis indicates the site operates as a credential phishing portal, designed to harvest user login credentials through a fraudulent interface mimicking the legitimate Airbnb platform. The threat type is classified as high-risk due to its direct targeting of financial and personal data, with no evidence of a drainer kit or secondary payloads at this stage.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 216.198.79.3, hosted on infrastructure associated with AS16509 (Amazon.com, Inc.). It is registered through Vercel Inc., though no creation date is publicly disclosed. Detection metrics include a VirusTotal score of 19/95 security vendors flagging the domain, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services, identified as WR1, which does not mitigate the underlying threat.

Current status remains active, with no evidence of takedown or mitigation efforts. Response actions should include immediate domain suspension via the registrar, IP-based blocking at the network level, and public disclosure to prevent further victimization. Despite existing detections, the domain continues to pose a significant risk due to its operational status and direct impersonation of a high-value brand. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on legitimate platforms, and report suspicious domains to security teams for further analysis.