saccharumresortsavoysignature[.]spahotel[.]guru

This domain, saccharumresortsavoysignature.spahotel.guru, is flagged as a generic phishing threat with high risk and remains active as of July 12, 2026. Evidence from VirusTotal shows 10 out of 91 security vendors flagging the domain, and it appears on one security blocklist, specifically blocked by PhishDestroy. The domain resolves to IP address 52.29.26.157, located in Germany on AWS EC2 infrastructure (eu-central-1 region). The SSL certificate is issued by Let's Encrypt (YE2), and the HTTP status returns 200, indicating the site is operational. The page title references Saccharum - Resort And Spa - Savoy Signature Calheta in Calheta, Madeira, Portugal, suggesting the domain impersonates a hospitality brand. The domain is registered through Spaceship, Inc., with nameservers launch1.spaceship.net and launch2.spaceship.net. The underlying technology stack includes WordPress, MySQL, PHP, Nginx, and HTTP/3. The Gridinsoft trust score is 0 out of 100, indicating no trust. Defenders should block the domain and IP at network perimeters, monitor for related subdomains or infrastructure, and warn users against interacting with the site. The exact phishing mechanism is not yet analyzed, but the low trust score and vendor flags strongly indicate malicious intent.