lesbories[.]spahotel[.]guru

PhishDestroy identifies lesbories.spahotel.guru as an active credential theft page designed to trick visitors into surrendering login credentials. The domain mimics a legitimate service (spahotel.guru) by appending a deceptive subdomain (lesbories), a tactic commonly used to bypass email filters and social engineering targets who may associate the parent domain with hospitality or wellness services. Security vendors have already blacklisted this page due to its malicious intent, with 13 out of 95 VirusTotal engines flagging it as malicious.

This domain was registered recently and flagged immediately. It acquired a Let’s Encrypt SSL certificate to appear trustworthy, resolving to IP address 52.29.26.157. Registrar data shows rapid deployment typical of disposable phishing domains. The site’s low detection count at first submission (13/95) indicates it evades some filters but is widely recognized as malicious by established security platforms, confirming its elevated risk status.

If you visited this site, do not enter any usernames, passwords, or payment details. Close the tab immediately and clear your browser cache if you interacted with the page. Run a full antivirus scan on your device. If you reused credentials on this site, change those passwords on other accounts and enable multi-factor authentication where possible. Report the domain to your email provider or browser for further blocking.