hyattregencylondonthechurchill[.]spahotel[.]guru

This domain is assessed as a credential phishing infrastructure impersonating Hyatt Regency London – The Churchill. Analysis indicates it is designed to replicate legitimate hotel branding to solicit user-entered authentication data or booking credentials under a fraudulent context. Although currently marked offline, the historical configuration and detection telemetry indicate prior malicious intent focused on credential harvesting through brand impersonation and deceptive page presentation.

Technical intelligence shows significant malicious classification, with VirusTotal reporting 20/95 security vendors flagging the domain. The domain was created on May 21, 2026 and is registered through Spaceship, Inc., indicating recent and potentially disposable infrastructure deployment. Hosting resolution points to IP 52.29.26.157 located in DE within AWS EC2 (eu-central-1), consistent with cloud-hosted phishing operations. The domain appears on 1 security blocklist and uses a Let's Encrypt E8 SSL certificate. Page title metadata falsely presents as “Hyatt Regency London - The Churchill - London, United Kingdom,” reinforcing brand impersonation behavior.

Users who may have interacted with this domain should treat any submitted credentials as compromised. Immediate mitigation steps include changing passwords for any accounts reused on the same credentials, enabling multi-factor authentication, and reviewing account activity for unauthorized access. If payment or personal information was entered, financial monitoring and potential card replacement should be considered. Systems that accessed the domain should be scanned for indicators of compromise, and DNS or browser-level blocking rules should be updated to prevent reaccess. Continued monitoring is recommended due to the infrastructure’s association with cloud-hosted phishing campaigns and rapidly re-deployable domains.