staging[.]test[.]nissan[.]daorel[.]ch

This domain, staging.test.nissan.daorel.ch, is identified as a credential theft phishing operation impersonating Valo.taxi, a ride-hailing service. The page title, Valo.taxi - नकद और सवारी (Cash and Ride in Hindi), suggests a targeted campaign aimed at users familiar with the brand, likely to harvest login credentials, payment details, or personal information. No direct evidence of a crypto drainer kit was observed, but the use of modern JavaScript frameworks (Vue.js, Nuxt.js) indicates a sophisticated frontend designed to mimic legitimate services while evading basic detection mechanisms. Analysis indicates the domain resolved to IP address 185.149.120.183 and employed a Let's Encrypt SSL certificate, a common tactic to appear legitimate. Technologies detected include Node.js, Bootstrap, and DDoS-Guard, the latter often associated with bulletproof hosting environments. The domain was flagged by 6 out of 95 security vendors on VirusTotal and appears on 2 security blocklists, including PhishDestroy and OISD. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. No creation date or registrar details were provided, but the presence of HSTS headers suggests an attempt to project security while engaging in fraudulent activity. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure may be repurposed or reactivated under a different name, given the use of DDoS-Guard and bulletproof hosting. Organizations should monitor for similar domains leveraging Valo.taxi branding or Hindi-language lures, particularly those hosted on 185.149.120.0/24. Users who interacted with the domain should reset credentials for Valo.taxi and associated financial accounts, enable multi-factor authentication where available, and review transaction histories for unauthorized activity. Network-level blocking of the IP and associated domain patterns is recommended for proactive defense.