bophutshaplus[.]spahotel[.]guru

This domain, bophutshaplus.spahotel.guru, is flagged as an active phishing site targeting travelers searching for SHA Plus-certified resorts in Thailand. Registered on April 16, 2026, through Spaceship, Inc., the domain resolves to an AWS EC2 instance in Frankfurt (52.29.26.157) and uses nameservers launch1.spaceship.net and launch2.spaceship.net. Infrastructure analysis reveals WordPress, MySQL, PHP, and Nginx with HTTP/3 support, a common stack for credential-harvesting pages. The page title explicitly references 'Bo Phut Resort And Spa - Sha Plus - Bophut, Thailand,' indicating an attempt to impersonate a legitimate hospitality brand. The domain is currently active, returning HTTP 200, and holds a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100. Seventeen security vendors on VirusTotal detect this domain as malicious. It appears on one security blocklist and is already blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (E7), which, while not inherently suspicious, is frequently abused in phishing campaigns due to its low-cost, automated issuance. Defenders should note the recent registration date (three months old) and the use of a .guru TLD, which has been associated with higher-than-average phishing activity. The AWS hosting and Spaceship nameservers suggest a disposable infrastructure pattern often seen in short-lived phishing campaigns. No specific phishing kit or payload has been confirmed at this time, but the combination of hospitality-themed branding, low trust scores, and active detections warrants immediate blocking at the DNS or proxy level. Further investigation should include monitoring for credential submission endpoints or secondary payload delivery.