mlodge[.]spahotel[.]guru

PhishDestroy identifies mlodge.spahotel.guru as a live fake hotel booking phishing domain impersonating M Lodge & Spa Saint-Martin-de-Belleville in France. The threat is classified as a high-risk phishing operation designed to steal payment credentials under the guise of a legitimate hotel booking service.

This domain was flagged by 18 of 95 VirusTotal security vendors and appears on multiple blocklists including OpenPhish and PhishingArmy. It resolves to IP 52.29.26.157, uses a Let's Encrypt SSL certificate, and was created recently with no established trust score in reputable databases. The fraudulent page title mimics the legitimate establishment to deceive users into entering personal and financial information.

As of today, mlodge.spahotel.guru remains actively online and continues to pose a direct threat to unsuspecting travelers. Immediate action is recommended: block the domain at network and endpoint levels, report the site to hosting providers and blocklists, and warn users to avoid booking through this fraudulent portal. Users who have interacted with this site should monitor financial accounts for unauthorized transactions and consider resetting passwords used on the page. Hosting providers should investigate the infrastructure supporting this domain and take action to suspend it to prevent further victimization.