cadizbahiabyqs[.]spahotel[.]guru

This domain is flagged as a high-risk phishing threat specializing in brand impersonation, specifically targeting travelers through a fraudulent hotel booking scheme. Analysis indicates the domain mimics the legitimate Cadiz Bahia hotel brand, likely to harvest payment details or personal credentials under false pretenses. The threat type aligns with generic phishing but exhibits characteristics of a sophisticated impersonation attack, leveraging trust in well-known hospitality brands to deceive victims. Infrastructure analysis reveals the domain cadizbahiabyqs.spahotel.guru was registered through Spaceship, Inc. and is currently hosted on an AWS EC2 instance located in Germany (IP: 52.29.26.157, eu-central-1 region). The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Security vendors on VirusTotal flag this domain at a concerning rate of 20 out of 95, with PhishDestroy and one additional blocklist already listing it as malicious. Despite these indicators, the domain remains active, suggesting either delayed takedown efforts or deliberate evasion tactics. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (52.29.26.157) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing or interacting with the domain, particularly in corporate or travel-related environments. End users should be educated on verifying hotel booking websites through official channels, such as the hotel’s direct contact information or verified booking platforms. Monitoring for similar domains registered via Spaceship, Inc. or hosted on AWS EC2 in the eu-central-1 region may help preemptively identify related threats. Incident response teams should treat any interaction with this domain as a potential credential or payment data compromise and initiate appropriate forensic and remediation procedures.