metrics[.]professorflapjacks[.]com

This domain, www.metrics.professorflapjacks.com, is identified as a credential theft infrastructure targeting users of Valo.taxi, a ride-hailing service. The page title, "Valo.taxi - नकद और सवारी" (translated: Valo.taxi - Cash and Ride), directly mimics the legitimate Valo.taxi brand, suggesting an intent to deceive users into submitting login credentials, payment details, or other sensitive information. No specific drainer kit signatures were detected in the initial analysis, but the use of modern frontend frameworks such as Vue.js and Ant Design indicates a sophisticated attempt to replicate the look and feel of the legitimate service. The inclusion of localized language (Hindi) further suggests targeting of regional users, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 15 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain was registered through Gandi SAS on July 3, 2016, though the phishing content appears to be a more recent deployment. It resolves to the IP address 185.149.120.183 and employs a Let's Encrypt SSL certificate, which may lend a false sense of legitimacy. Additional technologies detected include Cloudflare for content delivery, HSTS for forced HTTPS connections, and DDoS-Guard for protection against takedown attempts. The use of jsDelivr and cdnjs for loading external libraries is also noted, which may facilitate the rapid deployment of malicious scripts. As of the latest assessment, the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure remains a residual risk, as the domain could be reactivated or repurposed for future campaigns. Users who may have interacted with this domain are advised to immediately reset any credentials entered on the site, enable multi-factor authentication on associated accounts, and monitor for unauthorized transactions. Organizations should update their blocklists to include this domain and its associated IP address, while security teams are encouraged to investigate potential lateral movement or secondary infections stemming from this credential theft operation. The use of localized content and modern web frameworks underscores the evolving sophistication of phishing campaigns, necessitating continuous vigilance and proactive threat hunting.