pdcirdadmv[.]com

pdcirdadmv.com is flagged as a brand‑impersonation site targeting Revolut. The domain was registered on 20 June 2024 through Hostinger Operations UAB and uses the generic parking nameservers ns1.dns‑parking.com and ns2.dns‑parking.com. DNS resolution points to IP address 145.223.107.89, which is announced by AS47583 Hostinger International Limited and geolocated in the United States. No TLS certificate is deployed; an HTTP request returns a 200 response and the page title is “DELEGATION PDCI RDA DMV”, which does not reference the Revolut brand but is consistent with the observed impersonation pattern.

The site has been added to the PhishDestroy blocklist and appears on a single external security blocklist. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that one of ninety‑five scanning engines flags the domain, indicating at least one detection of malicious behavior. The domain currently shows an offline status, suggesting the operator may have taken the site down after detection. Uncertainty remains regarding the exact content served before takedown, the presence of credential‑harvesting forms, or any additional payloads, because no screenshots or code analysis are available.

Defenders should continue to block the domain at DNS and firewall layers, monitor the associated IP for any resurgence, and add the host to internal blacklists. Additional investigation of historical HTTP archives could reveal the phishing page’s structure, aiding detection signatures. Ongoing watch‑list updates from PhishDestroy and other feeds are recommended to capture any re‑registration attempts using similar naming patterns.