txdmv[.]pvfxm[.]cc

This report details a threat site impersonating the official TxDMV.gov domain. The page title was "TxDMV Home | TxDMV.gov," but the site was categorized as an impersonation scam specifically targeting the American Express brand. The primary threat posed was credential theft or financial fraud, as visitors may have been deceived into providing sensitive personal or account information under the guise of a legitimate government or financial service.

Technical analysis reveals significant indicators of malicious activity. The domain, txdmv.pvfxm.cc, was created on 2026-02-21 and resolved to IP address 104.21.91.80, which is hosted in the United States by AS13335 Cloudflare, Inc. The site used an SSL certificate identified as WE1. VirusTotal flagged the domain with 12 detections out of 95 vendors. It was specifically flagged by alphaMountain.ai, Cluster25, CRDF, Emsisoft, and Forcepoint ThreatSeeker, and appeared on one blocklist. The domain risk score is 73.

The site is currently reported as DOWN or OFFLINE. Based on the detection rate and risk score of 73, the threat level is assessed as moderate to high. Users who may have interacted with this site should monitor accounts for suspicious activity and change any credentials potentially compromised.