airbnb-clone-omega-gules[.]vercel[.]app

This domain, airbnb-clone-omega-gules.vercel.app, is identified as a high-risk brand impersonation threat targeting Airbnb users. Analysis indicates the site replicates Airbnb’s login interface to harvest credentials, a common tactic in account takeover schemes. The page title explicitly matches the legitimate brand, increasing its deceptive effectiveness. Infrastructure analysis reveals the domain resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509). It was registered on January 28, 2020, through Vercel Inc. and remains active despite detection by 21 out of 95 security vendors on VirusTotal. Google Safe Browsing classifies the domain as phishing, and it appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy. The domain remains operational as of the latest verification, posing an ongoing risk to users. Recommended response actions include blocking the domain at the network level, alerting potential targets via security awareness channels, and monitoring for credential reuse. Despite existing detections, the site’s continued activity underscores the need for proactive mitigation, particularly given its use of a well-known hosting provider to evade takedown efforts.