staging[.]mobileconnect[.]abqweather[.]com

This domain, staging.mobileconnect.abqweather.com, is flagged as a generic phishing site targeting users of Valo.taxi, a ride-hailing service. The page title, Valo.taxi - नकद और सवारी (Cash and Ride in Hindi), suggests the threat actor is attempting to deceive users into entering payment details or personal information under the guise of a legitimate taxi service. No specific drainer kit was identified, but the use of Alpine.js indicates dynamic content manipulation, likely for credential harvesting or fraudulent transaction processing. Analysis indicates the domain was registered through ENOM, INC. on August 09, 2000, though the phishing content appears to be a recent addition. It resolves to the IP address 185.149.120.183 and is currently detected by 16 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and employs technologies such as HSTS and DDoS-Guard, which may be used to evade takedowns or detection. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its malicious classification. As of the latest assessment, staging.mobileconnect.abqweather.com has been taken offline, likely due to intervention by security providers or hosting services. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to a similar one. Users who interacted with the site should immediately revoke any entered credentials, monitor financial transactions for unauthorized activity, and report the incident to relevant fraud prevention authorities. Organizations are advised to block the domain and its associated IP (185.149.120.183) at the network level to prevent further exposure.