visualize[.]race-queen-fetish[.]com

The domain visualize.race-queen-fetish.com is identified as a credential phishing site targeting users of Valo.taxi, a ride-hailing service. The page title, "Valo.taxi - नकद और सवारी" (translated: Valo.taxi - Cash and Ride), confirms the impersonation attempt. The domain is currently offline, though prior activity suggests it was actively harvesting login credentials or payment details under the guise of the legitimate service. Analysis indicates the domain was registered through GMO Internet, Inc. on December 21, 2020, and resolved to the IP address 185.149.120.183. It is flagged by 12 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The infrastructure employed technologies such as Ant Design, Vue.js, Cloudflare, and DDoS-Guard, alongside an SSL certificate issued by Let's Encrypt. The domain appears on two security blocklists, including PhishDestroy and OISD, further validating its malicious classification. Given the domain's current offline status, no immediate threat is posed. However, organizations and users should remain vigilant, as phishing infrastructure often resurfaces under new domains or IPs. It is recommended to block the domain and its associated IP (185.149.120.183) at the network level, update endpoint protection rules to include this indicator, and monitor for similar impersonation attempts targeting Valo.taxi or related services. Users who may have interacted with the site should reset credentials and review accounts for unauthorized activity.