licensefetcher[.]com

Analysis of the domain licensefetcher.com indicates an active fraudulent operation targeting individuals seeking to obtain driver licenses without testing. Registered on April 9, 2025, through Ultahost, Inc., the domain resolves to the IP address 192.142.10.5, hosted in the Netherlands under the same registrar. Nameservers ns1.ultahost.com through ns4.ultahost.com further confirm the domain's infrastructure ties to Ultahost. The site presents a page title explicitly stating 'Buy Driver's License Online Without Driving Tests,' a clear indicator of its fraudulent intent. As of July 12, 2026, the domain remains operational, returning an HTTP 200 status, and is flagged by one security blocklist. Five of ninety-one security vendors on VirusTotal have detected the domain as malicious, though the absence of additional context limits the interpretation of this detection rate. The domain employs a Let's Encrypt SSL certificate (R12), a common practice among both legitimate and malicious sites to enable HTTPS connections. Detected technologies include WordPress, MySQL, PHP, Yoast SEO, LiteSpeed, and JavaScript libraries such as Underscore.js and jQuery, suggesting a standard content management system setup rather than a custom-built phishing kit. No evidence currently links this domain to a specific phishing kit or broader campaign beyond its stated fraudulent offer. The Gridinsoft trust score of 0/100 aligns with its malicious classification but provides no additional technical insight. Defenders should prioritize blocking the domain and its associated IP address (192.142.10.5) at the network level. Monitoring for similar domains registered through Ultahost or resolving to the same IP may help identify related fraudulent activity. Given the domain's persistence and clear fraudulent messaging, continued vigilance is warranted.