gov[.]uk-dwpuah[.]icu

Analysis of the domain gov.uk-dwpuah.icu shows that it was registered on June 12, 2026 through the registrar Aceville Pte. Ltd. The domain resolves to the IP address 43.130.72.207, which is currently listed on a single security blocklist. Multiple threat‑intelligence feeds have flagged the site; PhishDestroy has already blocked the domain, and VirusTotal reports that 15 out of 91 scanned security vendors have identified it as malicious. The threat classification in the supplied intelligence is “generic phishing” with an elevated risk rating, and the domain is marked as active as of the report date, July 29, 2026.

The available evidence points to a typical phishing infrastructure: a recently created domain, a registrar that is frequently used for disposable or low‑cost registrations, and a single host IP that is already associated with malicious activity. The detection count on VirusTotal indicates that a minority of scanners have recognized the payload or hosting behavior, but the presence of any positive detections, combined with the blocklist entry and the PhishDestroy block, is sufficient to consider the domain hostile. No additional metadata such as SSL certificate details, HTTP response codes, or page titles are currently available, leaving the exact phishing lure and targeted brand unspecified.

Defenders should add gov.uk-dwpuah.icu to local blocklists and ensure that DNS filtering solutions deny resolution to the address 43.130.72.207. Network monitoring rules that flag outbound connections to this IP can help prevent compromised hosts from contacting the command‑and‑control host. Security teams should also update intrusion‑prevention signatures that reference the domain name or its registrar, Aceville Pte. Ltd., to catch future variations. Continuous re‑scanning on multi‑engine platforms such as VirusTotal is recommended, as additional detections may emerge as the payload evolves.