This is frequently implemented to add legitimacy to a domain – you can clearly see how it has been effective on you, and I assume you've got some technical competence!

The whois information looks clearly fishy:https://who.is/whois/e-airbnb.com

Registrar WHOIS Server: whois.publicdomainregistry.com ... Creation Date: 21-Mar-2014 ... Registrant Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org Registrant Street: C/O ID#10760, PO Box 16 Note - Visit PrivacyProtect.org to contact the domain owner/operator Note - Visit PrivacyProtect.org to contact the domain owner/operator

They just fooled you as well. I'd definitely have the main URL redirect to where people thought they should go, then have internal pages contain the fraudulent payment gateway.

Redirecting from one domain to another can be done without being affiliated with the target domain.