dev[.]www[.]check[.]amlonline[.]org

This domain, dev.www.check.amlonline.org, is identified as a credential phishing site impersonating Valo.taxi, a ride-hailing service. The page title, 'Valo.taxi - नकद और सवारी' (translated: 'Valo.taxi - Cash and Ride'), suggests targeting users in Hindi-speaking regions to harvest login credentials or financial details. No explicit drainer kit signatures were observed, but the use of modern JavaScript frameworks (Vue.js, Nuxt.js) indicates a sophisticated frontend designed to mimic legitimate service portals. The inclusion of HSTS and DDoS-Guard further suggests an attempt to appear technically legitimate while obscuring malicious infrastructure. Analysis indicates the domain was registered on May 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 185.149.120.183, which has been linked to prior phishing campaigns. VirusTotal detection metrics show 11 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing (GSB) status was not explicitly provided, but the elevated detection rate aligns with known phishing indicators. As of the latest assessment, dev.www.check.amlonline.org has been taken offline, likely due to hosting provider intervention or registrar suspension. However, the infrastructure remains a residual risk, particularly if the threat actors re-deploy the phishing kit under a newly registered domain. Users who interacted with the site prior to takedown should assume credential exposure and initiate password resets for Valo.taxi and any reused credentials. Organizations are advised to monitor network logs for connections to 185.149.120.183 and enforce blocklisting of the domain across security controls. The use of DDoS-Guard suggests potential resilience to takedown efforts, warranting continued vigilance for related campaigns.