gov-dwpqoo[.]top

The domain gov-dwpqoo.top was registered on June 12, 2026 through 阿里云计算有限公司 (Alibaba Cloud). It first appeared on a security blocklist and is currently listed by PhishDestroy as an active malicious site. VirusTotal analysis shows that 12 of 91 security vendors have flagged the domain, indicating a non‑trivial detection rate across independent scanners.

The risk level has been classified as elevated, and the operational status remains active as of the report date, July 29, 2026. Evidence suggests the domain is being used for a generic phishing campaign, though the specific target brand or service has not been disclosed in the available intelligence. The limited blocklist presence (single listing) and the moderate vendor detection count imply that the infrastructure may be in early deployment or employing evasion techniques that have not yet triggered broader detection.

Defenders should prioritize immediate blocking of the domain at perimeter devices, update any URL filtering and DNS sinkhole rules, and monitor for related indicators such as new domains registered by the same registrar within a comparable time window. Continuous re‑evaluation of the domain on VirusTotal and other threat‑intel platforms is recommended to capture any changes in detection posture. Given the elevated risk rating, security teams should treat any traffic to or from gov-dwpqoo.top as suspicious and investigate associated host activity for potential credential harvesting or malware delivery.