mansion[.]spahotel[.]guru

Analysis of the domain mansion.spahotel.guru confirms its classification as an active credential phishing site. Registered on April 24, 2026, through Spaceship, Inc., the domain resolves to IP address 52.29.26.157, hosted on AWS EC2 infrastructure in the eu-central-1 region (Germany). The domain's nameservers, launch1.spaceship.net and launch2.spaceship.net, are consistent with the registrar's infrastructure. As of July 12, 2026, the domain remains operational, returning an HTTP 200 status and presenting a page titled 'The Mansion Resort Hotel & Spa Ubud - Ubud (Bali), Indonesia,' which aligns with the identified scam type of credential phishing. Detection data indicates moderate but growing awareness among security vendors. The domain appears on one security blocklist, while a scan by 94 security vendors on VirusTotal resulted in 19 detections. The Gridinsoft trust score of 0/100 further supports the domain's malicious classification. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and Nginx, with HTTP/3 support, suggesting a relatively sophisticated setup. The combination of these technologies is frequently observed in phishing campaigns due to their flexibility and ease of deployment. The domain's hosting on a major cloud provider (AWS) is consistent with patterns seen in other credential harvesting operations, where attackers leverage scalable and resilient infrastructure. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related indicators of compromise, such as the associated IP address 52.29.26.157. Given the domain's active status and the specificity of its targeting (hotel guests), users who may have interacted with the site should be advised to reset credentials and review accounts for unauthorized activity.