pegasus[.]spahotel[.]guru

PhishDestroy identifies pegasus.spahotel.guru as an active credential-harvesting phishing domain designed to trick users into surrendering login credentials under the guise of a luxury spa service. The domain presents a spoofed reservation or booking interface that captures usernames, passwords, and payment details, then exfiltrates them to attacker-controlled servers. Analysis of live traffic confirms the site is currently intercepting user input and forwarding captured data to external endpoints, posing an immediate risk to anyone who interacts with its forms. This domain exhibits multiple red flags consistent with active phishing operations. It was flagged by 16 of 95 VirusTotal security vendors and appears on two independent blocklists curated by OpenPhish and PhishingArmy. The domain resolves to IP address 52.29.26.157 and leverages a Let’s Encrypt SSL certificate to appear legitimate. Despite this, the low vendor detection rate and cross-blocklist consensus indicate a rapidly evolving threat that evades static defenses. Users who visited pegasus.spahotel.guru should immediately change any passwords entered on the site and enable multi-factor authentication on all related accounts. Review financial statements for unauthorized transactions and monitor accounts for signs of credential misuse. Clear browser cookies and cached data related to the domain, and consider running a full system scan with updated antivirus tools. Report any suspicious activity to your IT security team or the appropriate platform abuse channels.