home[.]race-queen-fetish[.]com

This domain is flagged as a fraudulent taxi payment phishing site targeting users with deceptive payment requests. Analysis of the page title, Valo.taxi - नकद और सवारी (Cash and Ride), indicates an attempt to impersonate a legitimate ride-hailing or taxi service to harvest payment details or credentials. The site employs social engineering tactics, likely prompting users to enter sensitive financial information under the guise of completing a fare transaction, which can lead to unauthorized charges or identity theft.

Infrastructure analysis reveals multiple high-confidence threat indicators. The domain, created on December 21, 2020, is registered through GMO Internet, Inc., and resolves to the IP address 185.149.120.183. It is currently blocked by two security blocklists, PhishDestroy and OISD, and is flagged by 14 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, while the presence of DDoS-Guard suggests an attempt to obscure hosting origins or protect against takedown efforts. The Gridinsoft trust score of 0/100 further corroborates its malicious classification.

Users who visited this domain or interacted with its content should take immediate action to mitigate potential risks. First, terminate any active sessions with the site and avoid entering any personal or financial information. Monitor linked bank accounts and credit reports for unauthorized transactions, and consider placing a fraud alert with relevant financial institutions. Clear browser cache and cookies to remove any residual tracking elements, and run a full antivirus scan to detect potential malware or spyware. If payment details were submitted, contact the issuing bank to report potential fraud and request a card replacement. Additionally, report the domain to local cybersecurity authorities or consumer protection agencies to aid in broader mitigation efforts.