seattle[.]dmv-aux[.]icu

On July 29 2026 the domain seattle.dmv-aux.icu was identified as an active generic phishing infrastructure with an elevated risk rating. The domain was registered through Dynadot Inc on October 07 2025 and currently resolves to the IPv4 address 188.114.97.3. It appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, indicating that at least one anti‑phishing feed has flagged the host.

VirusTotal analysis shows that 11 of 91 scanned security vendors have flagged the domain, providing additional corroboration of malicious intent. No public information on SSL certificates, HTTP response codes, Safe Browsing status, or page title is available, so the exact content served by the site remains unverified. The limited detection footprint suggests that the domain may be in early stages of deployment or operating under a low‑visibility profile, but the presence on a blocklist and multiple vendor detections confirm that it is being used for credential harvesting.

Defenders should add the domain and its resolving IP to network deny lists, enforce DNS filtering to block resolution, and monitor outbound connections for traffic to 188.114.97.3. Continuous re‑evaluation is advised, as additional indicators such as page titles or further blocklist inclusions may emerge as the campaign progresses.