gov-dwpqii[.]top

Analysis of gov-dwpqii.top indicates an active phishing domain targeting UK government services, specifically Department for Work and Pensions (DWP) benefits. The domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with phishing infrastructure. As of July 29, 2026, the domain remains operational and is flagged by 13 of 91 security vendors on VirusTotal, confirming malicious intent.

It is also blocked by PhishDestroy and appears on at least one security blocklist, further validating its classification as a phishing threat. Infrastructure analysis reveals no additional hosting or SSL details at this time, limiting attribution to specific threat actors or campaigns. The exact content of the site has not been fully analysed, but the domain name and detection patterns suggest an attempt to impersonate official UK government portals for credential harvesting or fraudulent benefit claims.

Defenders should treat this domain as high-risk and implement blocking measures at the DNS or proxy level. Security teams are advised to monitor for related domains using similar naming conventions (e.g., 'gov-' prefixes) and report any user interactions with this site for incident response. No evidence of a phishing kit or brand-specific targeting beyond the implied DWP theme is currently available.