lsuba[.]spahotel[.]guru

The domain lsuba.spahotel.guru has been confirmed as a credential theft operation impersonating Le Tsuba Hotel, a legitimate Paris-based hospitality provider. The site is currently offline but previously presented a fraudulent booking interface designed to harvest login credentials, payment details, or personal data from unsuspecting users attempting to make reservations. Analysis indicates the domain was registered on April 28, 2026, through Spaceship, Inc., and resolved to IP address 52.29.26.157, hosted on infrastructure located in Germany (AWS EC2 eu-central-1). The SSL certificate was issued by Let's Encrypt (serial E7), a common tactic to lend superficial legitimacy. At the time of assessment, 18 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one active blocklist. The page title, 'Le Tsuba Hotel Paris - Paris, France,' directly mimics the branding of the legitimate hotel, increasing the likelihood of successful deception. Current infrastructure status shows the domain as offline, though historical indicators remain relevant for detection and prevention. Organizations are advised to block the domain and associated IP (52.29.26.157) at the network perimeter, update endpoint protection signatures to include this indicator, and monitor for related credential theft attempts. Users who interacted with the site should reset passwords and review accounts for unauthorized activity. Security teams should treat any future resolution of this domain as high-risk and investigate accordingly.