crystalwaterworldaquacollection[.]spahotel[.]guru

This domain is flagged as an elevated-risk credential harvesting phishing site targeting hospitality sector credentials. Analysis indicates the infrastructure was specifically designed to mimic legitimate hotel booking portals, likely to capture payment details or login credentials from unsuspecting travelers. Infrastructure analysis reveals the domain was registered on April 19, 2026 through Spaceship, Inc., resolving to IP address 52.29.26.157 hosted on AWS EC2 in Frankfurt, Germany. The SSL certificate was issued by Let's Encrypt (serial E7), a common pattern observed in phishing campaigns due to its free availability. VirusTotal detection shows 19 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist and has been taken offline following intervention by anti-phishing systems. Organizations should implement immediate mitigation measures including blocking the domain and IP address 52.29.26.157 at network perimeter devices. Security teams should search logs for connections to this infrastructure between April 2026 and its takedown date. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for hospitality-related services. Monitoring should be implemented for similar patterns including Let's Encrypt certificates issued to newly registered domains with hotel-related naming conventions.