pwood[.]spahotel[.]guru

The domain pwood.spahotel.guru is currently active and hosts a site whose page title reads “Petwood Hotel Woodhall Spa – Woodhall Spa, United Kingdom.” The site resolves to the AWS EC2 address 52.29.26.157 located in the Frankfurt region (Germany) and is served over HTTPS by a Let’s Encrypt certificate (E7). Infrastructure analysis shows the domain uses WordPress with MySQL, PHP, Nginx and HTTP/3, and it is delegated to the launch1.spaceship.net and launch2.spaceship.net nameservers operated by Spaceship, Inc. The domain was registered on 19 April 2026 and has a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100, indicating extreme risk. It appears on one public blocklist and is already blocked by PhishDestroy. VirusTotal scans report 15 of 94 security vendors flag the domain as malicious, and the observed activity is categorized as a “Crypto Drainer” scam, suggesting attempts to lure victims into transferring cryptocurrency. At present no additional content analysis is available beyond the page title; the exact phishing vector and credential‑capture mechanisms have not been publicly disclosed. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the launch*.spaceship.net nameservers, and add the IP to reputation lists. Continuous re‑scanning of the host and monitoring of new detections are recommended to capture any evolution of the malicious payload.