maravakaronbeach[.]spahotel[.]guru

This domain is flagged as a brand impersonation phishing site targeting Mandarava Resort and Spa, a legitimate hospitality provider in Karon Beach, Thailand. The infrastructure mimics the resort’s official branding, likely to deceive victims into submitting sensitive information such as booking details, payment credentials, or personal data under false pretenses. Analysis indicates the domain was designed to exploit trust in the resort’s name, a common tactic in hospitality-related phishing campaigns. Infrastructure analysis reveals the domain maravakakonbeach.spahotel.guru was registered on April 19, 2026, through Spaceship, Inc., and resolves to the IP address 52.29.26.157. It is currently offline but was previously detected by 19 out of 95 security vendors on VirusTotal, with trust scores of 1/100 (Scamadviser) and 0/100 (Gridinsoft). The domain appears on at least one security blocklist and was blocked by PhishDestroy. Detected technologies include WordPress, MySQL, PHP, Nginx, and HTTP/3, alongside a Let’s Encrypt SSL certificate, which may have been used to lend a false sense of legitimacy to the phishing page. Mitigation for organizations and individuals includes blocking the domain and its associated IP (52.29.26.157) at the network level. Security teams should monitor for similar impersonation attempts targeting hospitality brands, particularly those using newly registered domains with low trust scores. End users are advised to verify the authenticity of booking or payment pages by cross-referencing URLs with official resort communications and avoiding interaction with unsolicited links. Given the domain’s prior use of HTTPS, users should not rely solely on SSL indicators as a trust signal.