stirlghighlpartofthecairncollection[.]spahotel[.]guru

PhishDestroy identifies stirlghighlpartofthecairncollection.spahotel.guru as a high-risk crypto drainer impersonating the Stirling Highland Hotel—Part of the Cairn Collection. The domain mimics the legitimate Stirling Highland Hotel branding to trick users into connecting crypto wallets under the pretense of booking or claiming exclusive offers. No drainer kit artifacts were publicly disclosed, but the page title and SSL certificate suggest a sophisticated mimicry attempt targeting hospitality sector clients.

This domain was flagged by PhishDestroy with 18 out of 95 VirusTotal security vendors detecting malicious content, and it appears on 2 active phishing blocklists including OpenPhish and PhishingArmy. The domain resolves to IP address 52.29.26.157 and is protected by a Let’s Encrypt SSL certificate. It was registered under the .guru TLD and remains active as of the latest scan.

As of the most recent threat intelligence, this domain continues to operate despite blocklisting and detection efforts. Users are advised to avoid interaction and verify any hotel-related links using PhishDestroy’s real-time lookup tool. While the immediate risk is mitigated through blocklists, the domain’s continued activity indicates a persistent threat that may evolve or reappear under new domains. Users should remain vigilant when entering payment or wallet connection details on any hospitality website.