safari[.]spahotel[.]guru

The domain safari.spahotel.guru has been identified as a high-risk phishing site actively impersonating Safari Otel Antalya, a hotel brand based in Antalya, Turkey. This domain operates under the generic_phishing threat category and remains active as of the latest analysis. The page title explicitly mimics the legitimate hotel’s branding, suggesting an intent to deceive users seeking accommodation services or official hotel communications. Analysis of the domain’s infrastructure reveals multiple concerning indicators. The domain is flagged by 19 out of 95 security vendors on a major threat intelligence platform, indicating broad consensus on its malicious nature. It is registered through Spaceship, Inc., and resolves to the IP address 52.29.26.157, which is geolocated in Germany under AS16509, an autonomous system associated with a large cloud provider. The domain appears on at least one security blocklist, and its SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. No historical registration data or creation date was provided, but the active status and detection metrics confirm ongoing malicious activity. Current risk assessment classifies this domain as high severity due to its active impersonation of a trusted brand and confirmed phishing behavior. Organizations and users are advised to block all traffic to safari.spahotel.guru at the network perimeter and update endpoint protection rules to include this domain. Security teams should monitor for related indicators, such as the IP 52.29.26.157 and associated subdomains, as part of broader threat hunting efforts. Users who may have interacted with this domain should reset credentials, enable multi-factor authentication, and verify any transactions conducted through the site for fraudulent activity.