txdmv[.]akdyn[.]cc

Analysis of the domain txdmv.akdyn.cc indicates a confirmed brand impersonation campaign targeting American Express (Amex), currently assessed at an elevated risk level. The domain was registered on February 21, 2026, and has since been flagged by six of 95 security vendors on VirusTotal, alongside a listing on one security blocklist (PhishDestroy). Infrastructure analysis reveals the domain resolves to IP address 172.67.196.184, hosted under Cloudflare’s AS13335 in the United States. The SSL certificate is issued by WE1, a provider commonly observed in both legitimate and malicious traffic, offering no definitive signal of compromise on its own.

The page title, 'TxDMV Home | TxDMV.gov,' does not align with the targeted brand (Amex) or the domain name, suggesting either obfuscation or a secondary layer of deception unrelated to the primary scam objective. The domain was taken offline prior to this assessment, limiting further real-time validation of active content or payloads. However, the combination of brand impersonation classification, detection by multiple security vendors, and blocklist inclusion provides concrete evidence of malicious intent. Gridinsoft’s trust score of 0/100 further corroborates the domain’s association with fraudulent activity.

Defenders should treat this domain as compromised and prioritize blocking or monitoring any residual DNS queries, subdomains, or associated IPs. While the exact phishing kit or payload delivery mechanism remains unconfirmed, the infrastructure and detection patterns align with known brand impersonation tactics. No additional subdomains or linked infrastructure were identified in the available data, though historical DNS records or passive DNS may reveal further connections.