granguadalpbanus[.]spahotel[.]guru

PhishDestroy identifies granguadalpbanus.spahotel.guru as an active crypto drainer posing as a fraudulent hotel booking platform. This domain is currently operational and leverages deceptive techniques to trick users into connecting cryptocurrency wallets under false pretenses, enabling unauthorized fund transfers. The threat actor behind this campaign is actively distributing this URL through social engineering lures, including fake promotions or discounts for luxury hotel stays, ultimately leading victims to unknowingly authorize malicious wallet drainer scripts. This domain was flagged by 7 of 95 VirusTotal security vendors, indicating elevated malicious activity. It resolves to IP address 52.29.26.157 and utilizes a Let’s Encrypt SSL certificate to appear legitimate. While the registrar and creation date remain undisclosed in public records, VirusTotal detections and behavioral analysis confirm its use in active cryptocurrency theft operations. Trust scores from multiple threat intelligence platforms further corroborate its malicious classification, with additional indicators pointing to broader campaign infrastructure. Users and organizations are strongly advised to block access to granguadalpbanus.spahotel.guru at the network level using updated threat intelligence feeds. Avoid interacting with any URLs or QR codes associated with this domain, especially those claiming to offer hotel deals or booking services. If you have recently visited this site and connected a cryptocurrency wallet, revoke all active wallet connections immediately and transfer remaining funds to a secure, isolated wallet. Report the domain to your cybersecurity team and relevant authorities such as CERT or local cybercrime units to aid in ongoing takedown efforts. Stay vigilant against unsolicited links promising financial incentives.