staging[.]app[.]islamhorizon[.]com

This domain, staging.app.islamhorizon.com, is confirmed to operate as a credential theft site designed to harvest login details from users under the guise of Valo.taxi, a ride-hailing service. The site displays localized content in Hindi, including the phrase 'नकद और सवारी' (cash and ride), likely to deceive users into entering sensitive information such as usernames, passwords, or payment details. Such credential theft campaigns are commonly used to facilitate account takeovers, financial fraud, or further phishing attacks against compromised individuals. Analysis indicates this domain was registered on June 15, 2022, through Domain.com via Network Solutions, LLC. It resolves to the IP address 185.149.120.183 and employs technologies including Node.js, Bootstrap, Vue.js, and Nuxt.js, alongside HSTS and DDoS-Guard for infrastructure protection. Detection metrics reveal the domain is flagged by 14 out of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. Additionally, the domain appears on one security blocklist and is currently offline, though historical activity remains a concern. Individuals who visited staging.app.islamhorizon.com or entered credentials on the site should immediately take corrective action. Change passwords for any accounts accessed from this domain, particularly those linked to Valo.taxi or financial services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts. If payment details were submitted, contact financial institutions to report potential fraud and request card replacements. Users are advised to verify the legitimacy of domains before entering sensitive information, particularly those mimicking known brands.