capellasgapore[.]spahotel[.]guru

The domain capellasgapore.spahotel.guru has been identified as a credential phishing site impersonating Capella Singapore, a luxury hotel brand. Analysis confirms this domain is currently offline, though it previously hosted content mimicking the legitimate Capella Singapore website, as indicated by the page title 'Capella Singapore - Singapore, Singapore.' The threat type is classified as generic credential phishing, designed to harvest user login credentials or sensitive information through deceptive means. Infrastructure analysis reveals the domain was registered on April 19, 2026, through Spaceship, Inc., a domain registrar. It resolved to the IP address 52.29.26.157, hosted on infrastructure located in Germany within the AWS EC2 eu-central-1 region. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious domains. Detection metrics indicate the domain was flagged by 16 of 95 security vendors on VirusTotal, and it appears on one security blocklist. These indicators, combined with the domain's recent creation date and hosting on cloud infrastructure, align with patterns observed in phishing campaigns targeting high-profile brands. At present, the domain has been taken offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant, as threat actors may re-deploy similar infrastructure under new domains. It is recommended to monitor for newly registered domains containing variations of 'capella' or 'spahotel,' particularly those created through the same registrar or hosted on cloud providers. Network defenders should update blocklists to include the IP address 52.29.26.157 and the domain capellasgapore.spahotel.guru. Users who may have interacted with the site should reset credentials for any accounts associated with Capella Singapore and enable multi-factor authentication where available.