uat[.]mysql[.]race-queen-fetish[.]com

This domain, uat.mysql.race-queen-fetish.com, is identified as a phishing site specifically targeting users of Valo.taxi, a ride-hailing service. The page title, "Valo.taxi - नकद और सवारी" (translated: Valo.taxi - Cash and Ride), indicates an attempt to harvest payment credentials under the guise of a legitimate taxi service. The domain is currently offline, but prior activity suggests it was operational for credential theft and financial fraud. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain is flagged by 16 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, indicating high confidence in its classification as malicious. It resolves to the IP address 185.149.120.183 and was registered through GMO Internet, Inc. on December 21, 2020. The domain appears on one security blocklist and employs technologies such as Tailwind CSS, HSTS, and DDoS-Guard, which may be used to obfuscate its true nature. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. The current status of the domain is offline, but the infrastructure remains a potential risk for future malicious activity. Organizations and users are advised to block the domain and its associated IP address (185.149.120.183) at the network level. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Users who may have interacted with the site should immediately reset credentials for any financial or ride-hailing services and enable multi-factor authentication where available. Proactive threat hunting for similar domains with comparable naming patterns (e.g., brand names combined with unrelated terms) is recommended to mitigate further risks.