prelogon[.]patiobydesign[.]com

This domain, www.prelogon.patiobydesign.com, is identified as a credential harvesting phishing site targeting users of a ride-hailing service under the guise of Valo.taxi. The page title, written in Hindi as 'नकद और सवारी' (Cash and Ride), suggests an attempt to deceive users into entering sensitive login or financial information. The site employs a facade of legitimacy, using modern web technologies such as Vue.js, Ant Design, and Cloudflare to mimic a functional service, while actively harvesting user credentials or payment details. Analysis indicates multiple technical indicators supporting its malicious classification. The domain was registered on September 24, 2014, through GoDaddy.com, LLC, but its current activity aligns with phishing operations. It appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal, reflecting a consensus on its fraudulent nature. The domain resolves to the IP address 185.149.120.183 and employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the site's legitimacy. Additional infrastructure includes DDoS-Guard and HSTS, which are often used to obscure malicious activity and evade detection. Users who have visited www.prelogon.patiobydesign.com should immediately cease all interaction with the site. If credentials or payment information were entered, affected individuals must change passwords for all associated accounts, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. System scans using updated security tools are recommended to detect potential malware or backdoors. Given the domain's current offline status, users should remain vigilant for similar phishing attempts, particularly those impersonating ride-hailing or financial services.