carltontower[.]spahotel[.]guru

The domain carltontower.spahotel.guru was registered on 22 April 2026 through Spaceship, Inc. The site presents a page titled “Carlton Tower Hotel Dubai – Dubai, United Arab Emirates,” indicating an attempt to masquerade as the legitimate Carlton Tower Hotel brand. The domain is currently active, resolves to the IPv4 address 52.29.26.157, and serves content over HTTPS with a Let’s Encrypt certificate (issuer E7). Infrastructure analysis shows the address belongs to Amazon Web Services, region eu‑central‑1 (Germany). The host is an EC2 instance, consistent with the observed location tag “DE”. Nameserver delegation uses launch1.spaceship.net and launch2.spaceship.net, both belonging to the registrar’s default infrastructure. The HTTP response code is 200, confirming that the web server is actively delivering the fraudulent page. Threat intelligence indicates the site is classified as generic phishing. It appears on a single blocklist and has been flagged by PhishDestroy. VirusTotal scans report 18 of 95 security vendors labeling the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The limited detection footprint—only one blocklist entry—suggests the campaign may be in early stages or employing evasion techniques to avoid broader exposure. Defenders should block the domain at network perimeter and DNS resolvers, add the IP 52.29.26.157 to host‑based deny lists, and monitor for any outbound connections to the AWS eu‑central‑1 region that match the observed pattern. Continuous re‑evaluation is advised, as additional detections may emerge from other security vendors. Organizations that communicate with customers about hotel reservations should educate users to verify URLs and avoid entering credentials on sites lacking the official hotel’s domain.