damacmaisondistction[.]spahotel[.]guru

PhishDestroy identifies an active typosquatting phishing domain, damacmaisondistction.spahotel.guru, leveraging misspelled branding to impersonate legitimate services. This domain poses a credible risk to users seeking discounted luxury stays, as threat actors likely distribute malicious links via email spam or social engineering tactics. The imitation of a well-known hotel brand suggests a high degree of social engineering sophistication, with the ultimate goal of credential theft or financial fraud.

This domain was flagged by 13 of 95 security vendors on VirusTotal, indicating moderate detection but not universal consensus on its malicious nature. It resolves to IP address 52.29.26.157 and operates under a Let’s Encrypt SSL certificate to appear authentic. Analysis of domain metadata shows it uses the .guru top-level domain, a common choice among fraudulent sites due to its low registration barriers. While specific creation or registration dates were not disclosed, the structure and hosting configuration align with recent typosquatting campaigns targeting hospitality brands in Q1 2024.

Users who have accessed this domain should immediately cease any interaction and consider their credentials and payment information compromised if shared. Scan devices for malware using updated antivirus software and reset passwords for email and financial accounts, especially if the same credentials were reused. Report the domain to your security team and avoid visiting similar misspelled variations. Organizations are advised to block both the domain and IP at the network perimeter and distribute user advisories to prevent further exposure.