gov-dwpqty[.]top

Analysis as of July 29 2026 identifies gov-dwpqty.top as an active generic phishing infrastructure. The domain was registered on June 12 2026 through 阿里云计算有限公司, a Chinese cloud provider, and has been observed on a single security blocklist. VirusTotal records show that 14 of 91 scanning engines have flagged the domain, indicating a moderate level of consensus among security vendors that the site is malicious. The blocklist entry is corroborated by PhishDestroy, which currently blocks the domain. No additional public reputation services or safe‑browser checks are referenced in the available data set.

The short age of the domain, combined with its presence on a blocklist and the multi‑vendor detections, suggests deliberate use for phishing rather than an incidental compromise. At present no public SSL certificate information or HTTP status codes have been published, preventing verification of potential redirect behavior or certificate misuse. The lack of a disclosed page title means the visual content cannot be correlated with known phishing kits. Consequently, threat hunters should prioritize collecting DNS queries, TLS handshakes, and any observed payloads that reference the domain.

Integration of the domain into SOC dashboards, alongside the 14 vendor detections, will improve detection fidelity. Defenders should continue to deny any network traffic to the domain, add it to local and perimeter deny lists, and monitor for any new indicators that may emerge from subsequent scans or threat‑intel feeds. Organizations that receive suspicious communications referencing gov-dwpqty.top should treat them as malicious, instruct users to avoid clicking any links, and consider reporting the incident to a phishing takedown service. Ongoing observation is advised to capture any changes in hosting or additional detection coverage.