firstcollectiondubaibusessbay[.]spahotel[.]guru

This domain is classified as an elevated-risk credential phishing site targeting hospitality sector users. Analysis indicates the infrastructure was designed to mimic legitimate hotel booking portals, specifically The First Collection Business Bay in Dubai, to harvest login credentials or payment details from unsuspecting visitors. Infrastructure analysis reveals the domain resolves to IP address 52.29.26.157 and was registered through Spaceship, Inc. Security vendors flagged the domain in 19 out of 95 VirusTotal scans, while Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100 respectively. The domain appears on one security blocklist and is currently offline. The SSL certificate was issued by Let's Encrypt, providing basic encryption but no legitimacy assurance. Mitigation steps for credential phishing threats include verifying domain authenticity before entering sensitive information, cross-checking URLs with official hotel or booking platform sites, and implementing email filtering rules to block messages containing this domain. Organizations should update endpoint protection signatures to detect and block access attempts to this domain and monitor network logs for connections to 52.29.26.157. Users who may have interacted with this domain should reset credentials for any accounts accessed during the potential exposure window and enable multi-factor authentication where available.