wuaugalanthus[.]spahotel[.]guru

This domain, wuaugalanthus.spahotel.guru, is actively flagged as a high-risk brand impersonation phishing site targeting the Hotel Galanthus & Spa in Canillo, Andorra, as indicated by the page title and confirmed scam classification. Registered on April 16, 2026, through Spaceship, Inc., the domain resolves to IP 52.29.26.157, hosted on AWS EC2 in the eu-central-1 region (Germany). Infrastructure analysis reveals the use of Nginx, WordPress, MySQL, and PHP, with a Let's Encrypt SSL certificate (E7) and HTTP/3 support. Nameservers are launch1.spaceship.net and launch2.spaceship.net, consistent with the registrar's infrastructure. As of July 12, 2026, the domain returns an HTTP 200 status, indicating it is operational. Security vendor detections are notable: 19 of 91 engines on VirusTotal flagged the domain, while Gridinsoft and Scamadviser both assign a trust score of 1/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No specific phishing kit or payload has been confirmed in the available data, and the exact content or attack vector remains unanalyzed. Defenders should treat this domain as active and malicious, prioritizing blocking at DNS, proxy, or endpoint levels. Monitoring for related infrastructure (e.g., shared IPs, nameservers, or SSL certificates) may reveal additional compromised or attacker-controlled assets. Given the brand impersonation targeting a hospitality entity, credential harvesting or financial fraud is likely the objective.