booking-clone-next-js[.]vercel[.]app

This domain, booking-clone-next-js.vercel.app, is flagged as an active brand impersonation threat targeting Booking.com. Registered on January 28, 2020, the domain resolves to 216.198.79.3 (AS16509, Amazon.com, Inc., US) and is hosted on Vercel infrastructure, utilizing nameservers ns1.vercel-dns-3.com through ns4.vercel-dns-3.com. The page title explicitly identifies itself as a 'Booking.com clone,' confirming its intent to mimic the legitimate Booking platform. Analysis indicates the use of an Airdrop Scam phishing kit, a common tool for credential harvesting and fraudulent transactions. Security vendors have detected this domain, with 17 of 93 flagging it as malicious. It appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. The domain maintains a valid SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to potential victims. Despite its age, the domain remains operational as of July 12, 2026, with an HTTP 200 status indicating an accessible, live page. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Booking.com is frequently accessed. The combination of a recognized phishing kit, explicit brand impersonation, and active security vendor detections justifies a high-risk classification. While the exact content and functionality of the page remain unanalyzed, the available infrastructure and threat intelligence confirm its fraudulent purpose. Organizations should monitor for connections to 216.198.79.3 and associated Vercel-hosted subdomains to prevent credential theft or financial fraud.