savoy[.]spahotel[.]guru

PhishDestroy identifies savoy.spahotel.guru as a high-risk phishing site masquerading as The Savoy Hotel London to steal credit card details and personal data. The fraudulent page displays the correct hotel title and branding, tricking visitors into entering payment information under false pretenses. This domain was specifically designed to mimic a luxury hotel booking portal, making it especially dangerous for travelers seeking authentic accommodations. This domain was flagged by 17 out of 95 VirusTotal security vendors and is blocked by OpenPhish and PhishingArmy. It currently resolves to IP address 52.29.26.157 and is hosted on infrastructure associated with malicious activity. The site uses a Let's Encrypt SSL certificate to appear legitimate, but the domain was only recently registered and has already been added to 2 security blocklists. PhishDestroy analysis shows this is a fast-moving scam site with no legitimate connection to The Savoy Hotel London. If you visited savoy.spahotel.guru, do not enter any personal or payment information. Immediately close the browser tab, clear your cache, and run a full antivirus scan. If you used a password or credit card on the site, change those credentials on other accounts and contact your bank to report potential fraud. Report the site to PhishDestroy and your local cybercrime unit to help protect others. Avoid clicking any links from unsolicited emails or ads claiming to offer The Savoy Hotel London deals.