change-your-address[.]account[.]nhs[.]uk

PhishDestroy identified the domain change-your-address.account.nhs.uk as a credential phishing campaign specifically targeting users of the UK National Health Service (NHS). The domain was designed to mimic the official NHS change-of-address service, luring victims into entering sensitive login credentials and personal information. As of the latest analysis, the domain has been taken offline, mitigating immediate risk.

Technical indicators reveal that the domain was flagged by 1 out of 95 VirusTotal security vendors, indicating a low but present detection rate at the time of analysis. It was registered through Nominet UK, the official registry for .uk domains, and resolved to IP address 13.225.196.2. The domain was created on February 21, 2026, and its SSL certificate was issued by Amazon, using an Amazon RSA 2048 M01 key. Despite being relatively new, the domain appeared on 1 security blocklist, further corroborating its malicious intent.

Given the domain's current offline status, immediate phishing risk is reduced. However, users who may have encountered this site before takedown should change their NHS login credentials immediately and monitor accounts for unauthorized activity. PhishDestroy recommends always verifying URLs by checking the official NHS website directly and never entering credentials on pages accessed via unsolicited links. Security professionals should add this domain to blocklists and educate users about NHS-branded phishing attempts.