gov-dwpquv[.]top

Analysis indicates that the domain gov-dwpquv.top was registered through Dominet (HK) Limited on 12 June 2026. Within a month of creation the site has been flagged by multiple security services: PhishDestroy has placed it on its blocklist and it appears on one additional security blocklist. VirusTotal reports that 13 of 91 scanned security vendors classify the domain as malicious, reinforcing the elevated risk rating. The current operational status is active, and the threat type is identified as generic phishing.

No publicly available information on the hosting IP, ASN, SSL certificate, or HTTP response code has been disclosed, and the page title or content has not been captured in the intelligence feed, leaving the exact phishing payload unknown. The elevated risk level assigned by the reporting system reflects the combination of early detection, multiple vendor flags, and active blocklisting. Organizations should verify that email gateways are configured to quarantine messages containing URLs to this domain, and that web proxies enforce blocklist rules. Defenders should proactively deny any outbound or inbound traffic to this FQDN, add it to DNS sinkhole or firewall deny lists, and ensure that endpoint protection solutions are updated to reflect the 13 vendor detections.

Continuous monitoring of threat intel feeds for additional indicators, such as associated IP addresses or payload hashes, is recommended. Incident response teams should log any observed traffic to the domain as potential phishing attempts and correlate with user reports. Because the domain was created only a month prior, threat actors may be leveraging it in targeted campaigns; therefore, threat hunting queries should include recent DNS query logs for gov-dwpquv.top. Until additional forensic artifacts such as payload samples or hosting infrastructure are released, the domain remains a confirmed phishing indicator requiring immediate mitigation.