citypotbeach[.]spahotel[.]guru

PhishDestroy identifies citypotbeach.spahotel.guru as a live phishing site masquerading as the official City Point Beach & Spa Hotel in Didim, Turkey. The fraudulent page deploys HTTPS via a Let’s Encrypt certificate to appear authentic while harvesting login credentials entered by unsuspecting guests booking rooms. Attackers registered the domain solely to capture personal and payment data, redirecting victims to their own systems rather than the legitimate hotel portal. This domain was flagged by 18 of 95 VirusTotal security vendors and already appears on two major blocklists, including OpenPhish and PhishingArmy. Threat intelligence shows the site resolves to IP address 52.29.26.157 and remains active. Registrar records indicate creation after the start of 2024, confirming it is a recently spawned lure crafted to exploit travelers searching for accommodation in Didim. The low-overhead infrastructure—hosted on a cloud provider—allows rapid take-down and re-registration cycles typical of opportunistic credential-harvesting campaigns. If you visited citypotbeach.spahotel.guru, cease use immediately and check all online accounts for unauthorized access, especially banking and email. Run a reputable password manager scan for stored credentials tied to the domain. Report any suspicious charges and change passwords on other accounts using the same login details. If you entered payment information, contact your bank to request a new card and dispute fraudulent transactions. Preserve browser history and screenshots as evidence for local cybercrime units or consumer protection agencies investigating the campaign.