dmv-ca[.]hpmdn[.]icu

On 24 July 2026, the domain dmv-ca.hpmdn.icu was observed as an offline Microsoft‑impersonation infrastructure. The site was registered through NameSilo, LLC on 3 March 2026 and points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers earl.ns.cloudflare.com and mimi.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns the generic OpenResty page titled “Welcome to OpenResty!”.

VirusTotal records indicate that 12 of 94 scanned security vendors flagged the domain, suggesting malicious intent. The host has been added to a single security blocklist and is actively blocked by the PhishDestroy service. The domain’s risk rating is marked as elevated and its current status is offline, implying that the operator has taken the site down or is no longer serving content. Evidence confirms that the infrastructure is intended to impersonate Microsoft, though the specific phishing kit or credential‑collection page has not been captured.

Uncertainty remains regarding the exact payload, the targeting vector, and whether additional domains share the same hosting configuration. Defenders should continue to monitor the associated IP address and Cloudflare nameservers for re‑use, enforce blocklists that include dmv-ca.hpmdn.icu, and consider the domain in any Microsoft‑focused threat‑intel feeds. Organizations should also verify that users are not redirected to this host via compromised links or referral traffic, and apply standard email‑filtering rules to catch URLs that resolve to the same IP or Cloudflare edge. Ongoing vigilance is advised because the underlying hosting provider may host further impersonation campaigns.