courtyardbymarriottworldtradecentredubai[.]spahotel[.]guru

The domain courtyardbymarriottworldtradecentredubai.spahotel.guru was identified as a generic phishing threat with an elevated risk level, specifically engaged in brand impersonation of the Marriott hotel chain. The page title claimed to represent the Courtyard By Marriott World Trade Centre, Dubai, a tactic commonly used to deceive travelers and business clients into revealing sensitive information or making fraudulent bookings. No specific drainer kit was detected, but the site likely aimed for credential theft or payment data harvesting.

Technical indicators provide a clear picture of the threat. VirusTotal flagged the domain with 15 out of 95 security vendors marking it as malicious. The domain was registered through Spaceship, Inc. on May 18, 2026, and resolved to IP address 52.29.26.157. It was not listed on Google Safe Browsing but appeared on 1 security blocklist. The SSL certificate was issued by Let's Encrypt (E8), which is commonly abused by phishers due to its free and automated issuance.

As of the latest intelligence, the domain is currently offline, likely taken down after being reported. PhishDestroy recommends that users who may have interacted with this domain monitor for unusual account activity and change passwords if any credentials were entered. Remaining risk is low now that the site is offline, but similar domains may reappear under different hostnames. Users should always verify hotel URLs directly through official brand websites and avoid clicking on unsolicited links.