lakebuenavistavillageneardisney[.]spahotel[.]guru

PhishDestroy identifies lakebuenavistavillageneardisney.spahotel.guru as an active, elevated-risk credential phishing domain posing as a Disney-adjacent hotel spa site. This deceptive domain leverages a spoofed vacation theme to trick users into surrendering sensitive authentication data. This domain was flagged by 17 out of 95 VirusTotal vendors and is currently blocked by OpenPhish and PhishingArmy—two recognized industry blocklists. It resolves to IP 52.29.26.157 and uses a Let’s Encrypt SSL certificate, which may lend false legitimacy to visitors. The domain is hosted on a shared infrastructure that has already accumulated two security blocklist entries. Immediate action is required: users should avoid accessing this domain and verify any hotel-related links through official Disney channels. Organizations should block the domain at DNS and firewall levels, including the underlying IP 52.29.26.157. Endpoint protection rules should be updated to trigger on SSL certificates issued to Let’s Encrypt for this exact domain. Security teams are advised to inspect local DNS logs for recent resolutions to spahotel.guru and inspect browser histories for accidental access. Consider launching a user awareness alert regarding spoofed hospitality-themed phishing campaigns, especially those impersonating Disney properties.