pullmubaicreekcitycentre[.]spahotel[.]guru

pullmubaicreekcitycentre.spahotel.guru is currently active and returns HTTP 200. The site presents the page title “Pullman Dubai Creek City Centre – Dubai, United Arab Emirates”, suggesting a potential impersonation of the Pullman hotel brand, but the page content has not been publicly examined. Infrastructure analysis shows the domain resolves to 52.29.26.157, an AWS EC2 instance in the eu‑central‑1 region (Germany). The TLS certificate is issued by Let’s Encrypt (E8). The domain was registered on 18 May 2026 through Spaceship, Inc. and uses the launch1.spaceship.net and launch2.spaceship.net name servers. Reputation services flag the domain as high‑risk: Gridinsoft assigns a trust score of 0 / 100, and 15 of 92 VirusTotal scanners have reported malicious behavior. The domain is listed on one security blocklist and has been blocked by PhishDestroy. Because the observed indicators align with a generic phishing campaign, defenders should add the IP address and domain to deny lists, enforce TLS inspection, and monitor for related traffic. Continuous re‑evaluation is advised as additional payload or credential‑harvesting pages may appear.