dmv-ca[.]dycpu[.]icu

This domain, dmv-ca.dycpu.icu, was observed by multiple security services and is currently listed as offline. The domain was registered through NameSilo, LLC on March 03, 2026 and points to the IP address 104.21.95.246, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative nameservers earl.ns.cloudflare.com and mimi.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default OpenResty page with the title “Welcome to OpenResty!”.

VirusTotal records indicate that six out of ninety‑three scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist. PhishDestroy has also added the host to its blocklist, confirming its classification as a brand‑impersonation vector targeting Microsoft. The evidence suggests an attempt to exploit the Microsoft brand, although the specific payload or credential‑harvesting mechanism has not been disclosed.

Because the site is offline, active exploitation cannot be confirmed at this time, but the presence of multiple detections and blocklist entries warrants continued monitoring. Defenders should ensure that any outbound connections to 104.21.95.246 are blocked at the network perimeter, update endpoint and DNS filtering policies to include dmv-ca.dycpu.icu, and review logs for any prior attempts to contact the host. Additional analysis of any captured traffic or artifacts would be required to determine the exact malicious behavior and to assess whether compromised credentials have been exfiltrated.