hotelsim-5903[.]com

Analysis of hotelsim-5903.com shows an active generic phishing infrastructure that was registered on June 12, 2026 through Atak Domain Bilgi Teknolojileri A.S. The domain resolves to the IP address 172.67.190.149, which is hosted on a cloud service provider commonly used by malicious actors. As of the report date, the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing organization has observed malicious activity tied to this name. VirusTotal scans have returned 12 positive detections out of 91 security vendors, confirming that multiple engines classify the domain as malicious.

The elevated risk rating reflects the combination of recent creation, active status, and the observed detections. No public page title, SSL certificate details, or HTTP response codes are available in the current intelligence set, so the exact content served by the site remains unverified. Defenders should add hotelsim-5903.com to outbound and inbound filtering rules, enforce DNS sinkholing where possible, and monitor traffic to the associated IP address for anomalous patterns.

Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds will help track any changes in detection status. Organizations that rely on brand‑specific credentials should educate users about unsolicited login requests and encourage verification of URLs before entering credentials. Because the domain is newly created and already flagged by multiple vendors, rapid remediation is advised to reduce exposure to credential harvesting attempts.