kassrabayresortsuites[.]spahotel[.]guru

This domain is classified as high-risk due to brand_impersonation targeting the Sui ecosystem. The infrastructure is designed to deceive users by presenting itself as a legitimate hospitality service, while its primary function appears to be credential harvesting or fraudulent transactions under the guise of a trusted brand. Analysis indicates this is not an isolated incident but part of a broader pattern of domain abuse targeting blockchain and cryptocurrency entities. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Spaceship, Inc., and resolves to IP address 52.29.26.157, hosted on AWS EC2 in the eu-central-1 region (Germany). The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist (PhishDestroy). The page title, 'Kassandra Bay Resort, Suites & Spa Katsaros - Katsaros (Skiathos), Greece,' is crafted to mimic a legitimate resort website, further obscuring its true intent. Mitigation steps for brand_impersonation threats include immediate domain takedown requests to the registrar and hosting provider, citing the high-risk classification and detection metrics. Organizations should monitor for similar domains using variations of their brand name, particularly those registered through high-risk registrars or hosted on cloud infrastructure. End users should verify domain authenticity by cross-referencing official communications and avoiding interaction with unsolicited links. Security teams are advised to block the domain and its resolving IP (52.29.26.157) at the network level, and implement browser-based warnings for employees or customers attempting to access it.