rds[.]professorflapjacks[.]com

This domain is flagged as a credential harvesting phishing site targeting users of ride-hailing services, specifically impersonating Valo.taxi with localized content in Hindi. Analysis indicates the infrastructure was designed to deceive victims into submitting sensitive financial or personal credentials through fraudulent login interfaces, a common tactic in phishing campaigns aimed at financial fraud or identity theft. Infrastructure analysis reveals multiple high-risk indicators. The domain www.rds.professorflapjacks.com was registered on July 03, 2016, through Gandi SAS and currently resolves to the IP address 185.149.120.183. It is detected by 14 out of 95 security vendors on VirusTotal, appears on one security blocklist, and holds a Gridinsoft trust score of 0/100. The site employs Node.js, Bootstrap, Vue.js, and Nuxt.js for frontend development, alongside HSTS and DDoS-Guard for apparent security hardening—likely an attempt to evade detection or mitigate takedown efforts. The SSL certificate is issued by Let’s Encrypt, a legitimate provider often abused by threat actors to lend false credibility to malicious sites. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (185.149.120.183) at the network perimeter. Organizations should deploy endpoint protection rules to flag or quarantine any attempts to access this domain, particularly in sectors handling financial transactions or personal data. User awareness training should emphasize the risks of localized phishing content, such as the Hindi-language page title "Valo.taxi - नकद और सवारी," which may bypass traditional spam filters. Additionally, security teams should monitor for secondary infections or lateral movement if this domain was previously accessed within the network, as credential harvesting often precedes further compromise.