seattle[.]dmv-bua[.]icu

Analysis of the domain seattle.dmv-bua.icu indicates it is an active phishing site impersonating a Department of Motor Vehicles (DMV) portal, first observed on October 7, 2025. The domain is registered through Dynadot Inc and resolves to the IP address 104.21.24.15, which is associated with Cloudflare infrastructure. As of July 29, 2026, the domain appears on one security blocklist and is flagged by 15 of 91 security vendors on VirusTotal, suggesting elevated risk. The specific phishing kit or exact content of the site has not been analyzed, but the domain naming convention (seattle.dmv-bua) aligns with tactics used to deceive users into believing they are accessing a legitimate government service.

Defenders should note that the domain remains active and unblocked by major browser-based protections like Google Safe Browsing, though it is currently blocked by PhishDestroy. The use of Cloudflare IP space may complicate network-level blocking, as legitimate services also utilize this provider. No SSL certificate details or HTTP response codes are provided in the available intelligence, limiting further assessment of the site's operational status. The registration age (less than one year) is consistent with typical phishing domain lifecycles, where short-lived infrastructure is common.

Organizations are advised to add seattle.dmv-bua.icu to internal blocklists, monitor for DNS queries or web requests to this domain, and alert users to the risk of credential theft or personal data exposure. If additional details about the phishing kit or targeted user interactions become available, further mitigation steps—such as endpoint detection rules or email filtering adjustments—may be warranted. At present, the domain's infrastructure and detection metrics justify treating it as a credible threat.