tertentalsorrentomorngtonpensulabyihg[.]spahotel[.]guru

Analysis of the domain tertentalsorrentomorngtonpensulabyihg.spahotel.guru indicates a high-risk credential phishing campaign active as of July 12, 2026. The domain, registered on April 16, 2026, through Spaceship, Inc., resolves to IP address 52.29.26.157, hosted on AWS EC2 in the eu-central-1 region (Germany). Infrastructure analysis reveals the use of Nginx, PHP, MySQL, and WordPress, alongside HTTP/3, suggesting a structured web environment commonly exploited for phishing operations. The domain is served by nameservers launch1.spaceship.net and launch2.spaceship.net, and its SSL certificate is issued by Let's Encrypt (E7), a configuration consistent with both legitimate and malicious sites. The page title, 'Intercontinental Sorrento Mornington Peninsula By Ihg Hotel - Sorrento, Australia,' implies an attempt to impersonate a hospitality-related brand, though the exact content and targeting mechanism remain unconfirmed due to the absence of direct site inspection. Detection metrics indicate limited but clear malicious classification: the domain appears on one security blocklist, and 18 of 91 security vendors on VirusTotal flag it as malicious. Additional trust assessments, including a Scamadviser score of 1/100 and a Gridinsoft score of 0/100, further support its high-risk designation. While the domain remains active and returns an HTTP 200 status, its registration age (under three months) and hosting on a cloud provider frequently abused for phishing align with patterns observed in credential theft campaigns. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related infrastructure (e.g., sibling domains under the same registrar or nameservers), and treat any user interaction with the site as a potential compromise. Further analysis of the phishing kit or backend infrastructure may reveal additional indicators of compromise.