gov[.]uk-dwplik[.]icu

Analysis of the domain gov.uk-dwplik.icu indicates that it is actively being leveraged for credential harvesting as of the report date, July 29, 2026. The domain was registered on June 12, 2026 through the registrar Aceville Pte. Ltd. and resolves to the IP address 43.130.72.207. VirusTotal has recorded detections from 15 of 91 security vendors, confirming that multiple scanning engines have identified malicious characteristics associated with the domain.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing its classification as a high‑risk phishing infrastructure. No public page title, brand target, or phishing kit information is currently available, and the content of the hosted site has not been publicly disclosed, leaving the exact login capture mechanisms uncertain. Defenders should prioritize immediate containment by adding the domain and its resolving IP to network‑level blocklists, updating DNS filtering policies, and monitoring for any related command‑and‑control traffic.

Continued observation of VirusTotal updates and any emerging blocklist entries is recommended to track changes in detection coverage. Given the elevated risk rating and active status, proactive blocking and alerting are advised to mitigate potential credential theft attempts originating from this infrastructure.