airbnb-clone-xi-nine[.]vercel[.]app

This domain, airbnb-clone-xi-nine.vercel.app, operates as a credential harvesting phishing site designed to deceive users into divulging Airbnb login credentials. The site replicates the legitimate Airbnb interface, presenting a fraudulent login page that captures entered usernames, passwords, and potentially payment details. Such infrastructure is commonly deployed in campaigns targeting travelers, property hosts, or users seeking short-term rentals, with the intent to hijack accounts for financial fraud or identity theft. Analysis indicates the domain is hosted on infrastructure associated with a known content delivery network, registered through Vercel Inc. on March 08, 2026. The domain resolves to the IP address 216.198.79.131, located within the United States under AS16509 (Amazon.com, Inc.). It is flagged by 20 out of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WR1), provides a superficial layer of legitimacy but does not mitigate the underlying malicious intent. Users who have interacted with this domain should immediately cease all engagement and assume their credentials have been compromised. Affected individuals must change their Airbnb passwords, enable multi-factor authentication on all accounts, and monitor for unauthorized transactions or account activity. Financial institutions should be notified if payment details were entered. System administrators are advised to block the domain and associated IP address (216.198.79.131) at the network level to prevent further access. Given the high-risk classification and active status, organizations should treat this domain as a confirmed threat vector in their security policies.