parkroyalcollectionpickergsgapore[.]spahotel[.]guru

PhishDestroy identifies parkroyalcollectionpickergsgore.spahotel.guru as an active crypto-drainer domain engineered to steal cryptocurrency from visitors by mimicking the legitimate Parkroyal Collection Singapore property. The page is a near-exact replica of the real hotel’s spa booking flow, but every withdrawal or “Connect Wallet” button is wired to a malicious drainer script that siphons funds to attacker-controlled addresses under the guise of a “resort deposit” or “spa package purchase.” The domain’s registration and hosting choices, plus the presence of a drainer kit, indicate a deliberate, high-effort impersonation designed to bypass casual scrutiny and trick travelers into authorizing malicious transactions.

This domain resolves to IP 52.29.26.157 and was registered through an anonymized registrar that does not publish creation dates. A Let’s Encrypt SSL certificate is present, giving a false veneer of legitimacy. VirusTotal returns a detection score of 17 out of 95 security vendors as of the latest scan, placing it above the median for malicious domains. The domain is currently blocked by two real-time blocklists—OpenPhish and PhishingArmy—confirming its active abuse in the wild. PhishDestroy’s seed b2eead classifies the site as an elevated-risk crypto drainer with ongoing activity.

As of today, parkroyalcollectionpickergsgore.spahotel.guru remains active and resolvable. PhishDestroy continues to monitor the domain and propagate blocklist updates to browsers and security tools. Despite these actions, the risk remains elevated because new, similarly named domains can emerge within hours and the drainer kit itself may be reused across multiple impersonation campaigns. Users are strongly advised to verify any link that resembles this domain using PhishDestroy’s real-time lookup before entering credentials or connecting a wallet.