locarnoyouth[.]hostel[.]town

locarnoyouth.hostel.town is a newly registered domain (created June 18 2026) that hosts a credential‑phishing site impersonating the Locarno Youth Hostel in Switzerland. The site resolves to IP 172.86.104.14, which belongs to AS14956 RouterHosting LLC and is geolocated in the United States. Registration was performed through Spaceship, Inc., with authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. TLS is provided by a ZeroSSL ECC DV certificate issued by ZeroSSL GmbH, indicating a short‑lived, free SSL deployment. The web server runs Nginx with HTTP/3 support and serves a WordPress installation backed by MySQL and PHP. HTTP response code 200 is returned for the landing page, whose title reads “Locarno Youth Hostel – Locarno, Switzerland”. VirusTotal records show 18 of 91 security vendors flagging the domain, and the domain appears on a single public blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0 / 100. The threat is classified as generic credential phishing and is currently active with a high risk rating. Defenders should add the domain and its IP address to blocklists, monitor DNS queries for the associated nameservers, and consider sink‑holing traffic to prevent credential capture. Because the page content beyond the title has not been publicly analysed, further investigation is required to confirm the exact credential‑capture mechanisms and any additional infrastructure used.