next13-airbnb-clone-psi[.]vercel[.]app

This domain is flagged as an active high-risk credential harvesting platform targeting users of a popular short-term rental service. Analysis indicates the threat type is a generic phishing campaign designed to mimic the legitimate Airbnb interface, capturing login credentials, payment details, and personal information through fraudulent input forms. Infrastructure analysis reveals the domain next13-airbnb-clone-psi.vercel.app is registered through Vercel Inc. and resolves to the IP address 216.198.79.131, located in the United States. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider often exploited to lend credibility to malicious sites. Detection metrics show 21 out of 95 security vendors on VirusTotal have flagged this domain, while it appears on one additional security blocklist. The page title explicitly displays 'Airbnb,' further confirming its intent to deceive users. As of this assessment, the domain remains active and unmitigated. Mitigation requires immediate action from network administrators and end users. Organizations should block the domain and its resolving IP (216.198.79.131) at the firewall or DNS level to prevent access. Users who may have interacted with the site should reset credentials for any accounts entered, particularly those associated with financial services. Multi-factor authentication should be enabled where available to reduce the impact of credential theft. Security teams are advised to monitor for indicators of compromise, including the domain, IP, and SSL certificate thumbprint, in logs and network traffic. Given the domain's hosting on a legitimate platform, verification of SSL certificates and scrutiny of subdomains with similar naming patterns are recommended to identify potential copycat threats.