ennakhilmarrakech[.]spahotel[.]guru

Analysis of ennakhilmarrakech.spahotel.guru shows an active phishing infrastructure hosting a page titled “Ennakhil Marrakech Hotel & Spa Marrakesh - Marrakesh, Morocco”. The domain resolves to 52.29.26.157, an AWS EC2 instance in the eu‑central‑1 region of Germany. The server presents a valid Let’s Encrypt certificate (issuer E7) and returns HTTP 200 for the root URL. Registration was performed through Spaceship, Inc., with authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100) and the domain is listed on a single security blocklist. PhishDestroy has already blocked the site, and VirusTotal records 19 of 91 scanners flagging the domain. The observed characteristics, together with the designation “Crypto Drainer”, indicate a high‑risk generic phishing campaign likely intended to lure victims into transferring cryptocurrency. At present no additional payloads or hosting details are disclosed, leaving the full scope of the operation uncertain. Defenders should block the domain and its resolved IP, monitor for similar sub‑domains under the same registrar or nameserver pair, and enforce TLS inspection to detect any credential‑stealing traffic. Continuous re‑evaluation is advised as threat actors may shift infrastructure or repurpose the domain.