RTO Scam Wave Continues

CRIL observed an active, browser-based phishing campaign targeting Indian vehicle owners via unsolicited SMS links to cloned e‑Challan/Parivahan portals; the fake sites dynamically fabricate challan records and redirect victims to payment pages that harvest full card details. Investigation links dozens of lookalike domains to shared infrastructure across IPs (101.33.78.145 and 43.130.12.41), shows reuse of templates for BFSI and logistics lures, and provides IOCs and recommendations for monitoring, takedowns, and SMS filtering.