app[.]professorflapjacks[.]com

This domain, app.professorflapjacks.com, operates as a phishing site designed to mimic Valo.taxi, a ride-hailing service. The site displays a page titled 'Valo.taxi - नकद और सवारी' (Cash and Ride in Hindi), suggesting it targets users under the pretense of processing payments or ride bookings. Victims are likely tricked into entering sensitive information such as login credentials, payment card details, or personal identification, which are then harvested by threat actors for financial fraud or identity theft. Analysis indicates this domain was created on July 03, 2016, and is registered through Gandi SAS. Despite its age, it has been repurposed for malicious activity, as evidenced by detection from 14 out of 95 security vendors on VirusTotal. The site resolves to the IP address 185.149.120.183 and employs technologies including Node.js, Bootstrap, Vue.js, and Nuxt.js, alongside security features like HSTS and DDoS-Guard, which may be used to evade takedowns or detection. The SSL certificate is issued by Let's Encrypt, a common tactic to appear legitimate. The domain is currently offline but remains flagged on one security blocklist, with a trust score of 0/100. If a user visited this domain or entered any information, immediate action is required. First, revoke any credentials or payment details submitted, including passwords, credit card numbers, or personal identification. Monitor financial accounts for unauthorized transactions and report any suspicious activity to the relevant institution. Run a full system scan using updated security software to detect potential malware or backdoors. Users should also enable multi-factor authentication on all critical accounts to mitigate further risk. Given the elevated risk level, affected parties are advised to remain vigilant for follow-up phishing attempts via email or SMS, as threat actors may reuse stolen data for additional attacks.