bestwesternburnskensgton[.]spahotel[.]guru

This domain is flagged as a high-risk credential harvesting phishing site targeting users seeking hotel booking services. Analysis indicates the domain impersonates a legitimate hotel brand to deceive visitors into submitting login credentials, payment details, or personal information. The threat type is classified as generic_phishing with an active status, posing immediate risk to unsuspecting users. Infrastructure analysis reveals the domain was registered through Spaceship, Inc. on May 21, 2026, and currently resolves to IP address 52.29.26.157, hosted on AWS EC2 in the eu-central-1 region (Germany). VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E8), and the domain appears on one security blocklist, specifically PhishDestroy. The page title, "Best Western Burns Hotel Kensington London - London, United Kingdom," further confirms the impersonation attempt. Mitigation steps include immediate blocking of the domain and its resolving IP (52.29.26.157) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate details into endpoint detection and response (EDR) and security information and event management (SIEM) systems. Users who may have interacted with the domain should be advised to reset credentials, monitor financial transactions, and scan devices for malware. Organizations should also review logs for connections to 52.29.26.157 or DNS queries for bestwesternburnskensgton.spahotel.guru to identify potential compromise.