shangrilalouessrokmauritius[.]spahotel[.]guru

Analysis of the domain shangrilalouessrokmauritius.spahotel.guru indicates active credential phishing targeting users associated with the Shangri-La Le Touessrok resort in Mauritius. The domain, registered on April 17, 2026, resolves to IP address 52.29.26.157, hosted on AWS EC2 infrastructure in Frankfurt, Germany (eu-central-1). Infrastructure analysis reveals nameservers launch1.spaceship.net and launch2.spaceship.net, with the domain registered through Spaceship, Inc. The site presents an HTTP 200 status and uses a Let's Encrypt SSL certificate (serial E7), which does not inherently indicate malicious activity but is commonly exploited in phishing operations. The page title, "Shangri-La Le Touessrok, Mauritius Trou d'Eau Douce - Trou d'Eau Douce, Mauritius," suggests an attempt to impersonate the legitimate Shangri-La resort brand. While the exact content of the phishing page remains unanalyzed, the scam type is classified as credential phishing based on available intelligence. Detection data from VirusTotal shows 19 of 91 security vendors flagging the domain as malicious, though this does not constitute definitive proof of compromise. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, further indicating high-risk status. Technologies detected on the domain include WordPress, MySQL, PHP, and Nginx, with HTTP/3 support. These components are legitimate but frequently abused in phishing campaigns due to their widespread use and ease of deployment. Defenders should treat this domain as an active threat, block it at the DNS or proxy level, and monitor for credential harvesting attempts originating from it. No evidence currently suggests lateral movement or secondary payload delivery, but continuous monitoring is recommended given the domain's persistence and infrastructure.