telalapartments[.]spahotel[.]guru

This domain, telalapartments.spahotel.guru, is identified as a credential theft operation impersonating Telal Hotel Apartments, a legitimate hospitality entity based in Dubai, United Arab Emirates. Analysis indicates the threat actor designed the site to harvest login credentials, payment details, or personal information from victims under the guise of a hotel booking platform. No crypto drainer kit signatures were observed, but the domain exhibits classic indicators of credential harvesting, including form fields for sensitive data submission and brand impersonation tactics. Infrastructure analysis reveals the domain was registered on April 25, 2026, through Spaceship, Inc., and resolves to IP address 52.29.26.157, hosted on AWS EC2 infrastructure in the eu-central-1 region (Germany). The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal. It employs a Let's Encrypt SSL certificate (serial number E7) to mimic legitimacy, though this does not mitigate the underlying threat. The page title, 'Telal Hotel Apartments Dubai - Dubai, United Arab Emirates,' directly mirrors the branding of the legitimate entity, increasing the likelihood of successful deception. As of the latest assessment, the domain has been taken offline, likely due to automated takedown mechanisms or registrar intervention. However, residual risk persists due to the potential for re-registration or migration to a new domain under the same threat actor. Users who interacted with the domain prior to its takedown are advised to reset credentials for any accounts accessed during the exposure window, monitor financial statements for unauthorized transactions, and verify the authenticity of any communications claiming to originate from Telal Hotel Apartments. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.