Cybersecurity Platform Cyble Uncovers Over 36 Fake e-Challan Domains

Cyble Research and Intelligence Labs (CRIL) has identified a major phishing operation using fake e-Challan websites to target vehicle owners in India. The campaign employs over 36 bogus domains to steal banking information, building on earlier malware-based tactics with browser-focused methods.

The scheme uses local elements like Reliance Jio phone numbers and State Bank of India links to appear legitimate. Shared systems also hit banking and logistics sectors.

Daksh Nakra, Senior Manager of Research and Intelligence at Cyble, noted the shift to browser fraud lowers barriers and widens reach. He pointed out attackers use trusted Indian institutions to boost credibility.

The attack starts with SMS alerts about unpaid fines, threatening legal action. Links lead to cloned sites that create fake violations for any input, showing small fines like ₹590 with deadlines. Payment pages limit options to cards, collecting full details without verification.

Infrastructure analysis shows primary domains mimicking e-Challan services, plus HSBC and logistics fakes like DTDC and Delhivery. Secondary sites copy Parivahan portals with generated domains for evasion. The campaign spans government, banking, and e-commerce users.

Key Safety Tips From Cyble

• Never click links in unexpected SMS about traffic fines.  
• Always check any penalty directly on the official Parivahan portal (parivahan.gov.in).  
• Carefully inspect website addresses for spelling mistakes or strange domain endings.  
• Be wary of payment pages that accept only credit/debit cards.  
• Immediately report suspicious messages to cybercrime authorities.

Cyble provides AI-powered threat intelligence for real-time cyber risk visibility through research, dark web monitoring, and attack surface management. Its platform helps detect and prevent attacks.

Also read: Triumph to Implement Price Hike in India from January 2026