autoconfig[.]suryagharyojna[.]com

This domain is flagged as an elevated-risk credential theft operation impersonating Valo.taxi, a ride-hailing service. Analysis indicates the infrastructure was designed to harvest user login credentials, payment details, or personal data under the guise of a legitimate taxi platform. The inclusion of localized text (नकद और सवारी, translating to 'cash and ride') suggests targeting of Hindi-speaking users, a tactic commonly employed to increase victim compliance and reduce suspicion. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 19, 2024, through a widely used registrar, with resolution to IP address 185.149.120.183. Security vendors on VirusTotal flagged the domain at a rate of 13/95, while independent trust scoring systems assigned a 0/100 trust rating. The domain appears on two security blocklists, including PhishDestroy and OISD, and is currently offline. Detected technologies include Node.js, Bootstrap, Vue.js, and Nuxt.js, alongside HSTS and DDoS-Guard, which may have been leveraged to obfuscate malicious activity or enhance infrastructure resilience. The SSL certificate issued by Let's Encrypt further mimics legitimate services, though this is a common tactic in credential theft campaigns. Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP address (185.149.120.183) at the network perimeter. Security teams should monitor for any attempts to access this domain from internal networks, particularly in regions where Valo.taxi operates or where Hindi-speaking users are present. End-users who interacted with the domain should reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and review financial statements for unauthorized transactions. Given the localized targeting, awareness campaigns in Hindi or regional languages may help reduce further victimization. Proactive monitoring for similar domain registrations (e.g., typosquatting or brand impersonation) is recommended to preempt future threats.