zeuselevaajul[.]spahotel[.]guru

zeuselevaajul.spahotel.guru is a phishing domain that has been flagged as malicious by 8 out of 91 vendors on VirusTotal. The domain was first detected on June 22, 2026, and has since been taken offline. It was hosted on an Amazon server in Germany, with the IP address 52.29.26.157. The SSL certificate was issued by Let's Encrypt, indicating an attempt to appear legitimate.

The domain is listed on two public blocklists, including PhishDestroy and OpenPhish, which highlights its recognition as a threat by multiple security platforms. The platform risk score for this domain is 63 out of 100, suggesting a moderate level of threat. Despite its current offline status, the domain's history of malicious activity makes it a noteworthy case in phishing domain analysis.

Phishing domains like zeuselevaajul.spahotel.guru exploit the initial window between registration and detection by security vendors. This domain's detection by PhishDestroy before widespread recognition underscores the importance of early threat identification. The absence of a known registrar further complicates tracking efforts, emphasizing the need for continuous monitoring of such domains.