westdubaimaseyahibeachwaterpark[.]spahotel[.]guru

This domain, westdubaimaseyahibeachwaterpark.spahotel.guru, is a credential theft operation impersonating The Westin Dubai Mina Seyahi Beach Resort and Waterpark. The site presents a fabricated booking interface designed to harvest login credentials, payment details, and personal information from visitors attempting to make reservations. Victims are likely lured through malicious advertisements, search engine poisoning, or phishing emails directing them to the fraudulent domain instead of the legitimate hotel website. Analysis indicates this infrastructure was established specifically for malicious purposes. The domain was registered on April 22, 2026, through Spaceship, Inc., an unusual registrar choice for legitimate hospitality services. It resolves to 52.29.26.157, an AWS EC2 instance in Frankfurt, Germany, rather than servers typically associated with hotel chains. Security vendors on VirusTotal flagged this domain, with 19 out of 95 engines detecting malicious activity. The Let's Encrypt SSL certificate (serial E7) provides a false sense of security, as attackers commonly use valid certificates to appear legitimate. If you visited westdubaimaseyahibeachwaterpark.spahotel.guru or entered any information on the site, immediate action is required. First, disconnect the device from the network to prevent potential malware communication. Change all passwords for accounts accessed on the device, particularly those for email, banking, and travel services. Enable multi-factor authentication where available. Monitor financial statements for unauthorized transactions and consider placing a fraud alert with credit bureaus. Report the incident to local cybercrime authorities and the legitimate hotel to assist in takedown efforts. The domain is currently offline, but threat actors may redirect victims to alternate infrastructure.