cliff[.]spahotel[.]guru

The domain cliff.spahotel.guru has been identified as a phishing site specifically targeting users through fake hotel booking pages. Analysis of the page title, 'The Cliff Hotel,' indicates an attempt to impersonate legitimate hospitality services, likely to harvest personal and financial information from victims under false pretenses. The domain is currently offline, but prior activity suggests it was actively used for credential theft and fraudulent transactions. Infrastructure analysis reveals the domain was registered on May 20, 2026, through Spaceship, Inc., and resolves to the IP address 52.29.26.157, hosted on a cloud provider in Germany (AWS EC2, eu-central-1 region). Security vendors on VirusTotal flagged the domain, with 17 out of 95 detecting it as malicious. The domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt, identified by the serial number E8. These technical indicators align with patterns observed in phishing campaigns leveraging cloud infrastructure for rapid deployment and evasion. The domain's current offline status reduces immediate risk, but historical data suggests it may resurface under a different name or infrastructure. Organizations and individuals are advised to block the domain and its associated IP address (52.29.26.157) at the network level. Users who interacted with the site should monitor accounts for unauthorized activity and reset credentials for any services accessed during the exposure window. Security teams should correlate logs for connections to the IP address and domain to identify potential compromised endpoints. Proactive monitoring for newly registered domains with similar naming patterns or registrant details is recommended to mitigate future threats.