demo[.]admin[.]public[.]pdwithchloe[.]com

This domain is flagged for elevated-risk credential theft activity targeting users through a fraudulent portal impersonating Valo.taxi, a ride-hailing service. Analysis indicates the site employs social engineering tactics to harvest login credentials, payment details, or personal information under the guise of legitimate service interactions. The inclusion of Hindi text (नकद और सवारी) suggests regional targeting, likely aimed at users in South Asia or diaspora communities familiar with the brand. Infrastructure analysis reveals the domain demo.admin.public.pdwithchloe.com was registered on July 28, 2023, through Squarespace Domains II LLC. It resolves to IP address 185.149.120.183 and employs a Let's Encrypt SSL certificate for apparent legitimacy. Security vendor detections on VirusTotal stand at 14/95, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and utilizes technologies including Node.js, Bootstrap, Vue.js, Nuxt.js, HSTS, and DDoS-Guard for operational resilience. The page title, Valo.taxi - नकद और सवारी, directly mimics the legitimate service, reinforcing the impersonation scheme. Mitigation requires immediate blocking of the domain and its associated IP (185.149.120.183) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems and conduct retrospective log analysis for connections to the domain or IP. Users who interacted with the site must reset credentials for Valo.taxi and any reused passwords across other platforms. Security teams should monitor for follow-up phishing attempts or lateral movement using harvested credentials. Awareness training should emphasize verification of domain authenticity before entering sensitive information, particularly for services involving financial transactions.