ramadabywyndhamdubaibarshaheights[.]spahotel[.]guru

Analysis indicates that ramadabywyndhamdubaibarshaheights.spahotel.guru is an active generic phishing domain exhibiting characteristics consistent with brand impersonation. The observed page title references a well-known hospitality property, suggesting an attempt to leverage recognizable branding to increase user trust and facilitate phishing objectives. At the time of assessment, the domain remains active and should be considered a high-risk destination.

Infrastructure analysis reveals that the domain was created on June 08, 2026 and is registered through Spaceship, Inc. DNS resolution identifies IP address 52.29.26.157 as the current hosting endpoint. Detection telemetry shows the domain is flagged by 19 of 95 VirusTotal security vendors, indicating a comparatively elevated level of security concern. The domain appears on 1 security blocklist and has been blocked by a phishing-focused intelligence source. Certificate data indicates the use of a Let's Encrypt / YE2 SSL certificate. These indicators collectively support classification as a high-risk phishing asset.

The domain is currently still active, increasing the likelihood of continued exposure to users who encounter related links or campaigns. Recommended defensive actions include immediate domain blocking at network and endpoint controls, monitoring for connections to IP address 52.29.26.157, and reviewing logs for evidence of user interaction. Security teams should investigate any credentials or information potentially submitted through the site and maintain ongoing surveillance for related infrastructure. Given the active status, recent registration date, and 19/95 detection rate, the residual threat level remains significant.