sso[.]amlonline[.]org

This domain, sso.amlonline.org, is identified as a credential-harvesting phishing site targeting users of Valo.taxi, a ride-hailing service. The page mimics legitimate login portals, presenting a localized interface in Hindi with the title 'Valo.taxi - नकद और सवारी' (Cash and Ride) to deceive victims into submitting sensitive account details, including usernames, passwords, and payment information. The fraudulent nature of the site is reinforced by its use of modern web frameworks, which may lend an air of legitimacy to unsuspecting users while facilitating data exfiltration to attacker-controlled servers. Analysis indicates the domain exhibits multiple high-risk indicators. According to VirusTotal, 12 out of 95 security vendors have flagged sso.amlonline.org as malicious, reflecting a consensus among detection engines regarding its phishing intent. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 03, 2026, a future date that suggests either a registration error or deliberate obfuscation to evade temporal scrutiny. It currently appears on one security blocklist and resolves to the IP address 185.149.120.183, which has been associated with other phishing campaigns. Infrastructure analysis reveals the use of Node.js, Bootstrap, Vue.js, and Nuxt.js, alongside DDoS-Guard for protection, a combination often employed to create responsive, scalable phishing pages that resist takedown efforts. Users who have visited sso.amlonline.org or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset passwords for Valo.taxi and any other accounts where identical or similar credentials may have been reused. Enable multi-factor authentication (MFA) wherever possible to add an additional layer of security. Monitor financial statements and transaction histories for unauthorized activity, as stolen credentials may be exploited for fraudulent payments or identity theft. If personal or payment data was submitted, consider reporting the incident to relevant financial institutions and credit bureaus to place fraud alerts. Additionally, scan local devices for malware, as phishing sites may deploy malicious scripts or redirect to exploit kits. Organizations should update blocklists to include this domain and its associated IP to prevent further access.