gov[.]uk-dwpilt[.]icu

Analysis of the domain gov.uk-dwpilt.icu shows that it was registered on June 12, 2026 through the registrar Aceville Pte. Ltd. The domain resolves to the IPv4 address 43.130.72.207, which is currently the sole hosting endpoint observed for this indicator. Google Safe Browsing classifies the site as a social engineering threat, and the domain appears on a single external security blocklist. Independent phishing mitigation service PhishDestroy has already added the domain to its blocklist, confirming active mitigation. VirusTotal reports that 13 of 91 scanned security vendors have flagged the domain, indicating a moderate level of consensus among detection engines.

No additional metadata such as SSL certificate details, HTTP response codes, or page title information is publicly available at this time, limiting the ability to confirm the exact content served. The threat is rated high risk and the indicator status is currently active, meaning that the domain is still reachable and may be serving malicious content. Because the domain uses a .icu TLD and mimics a UK government sub‑domain pattern, it is likely intended to deceive UK citizens seeking welfare or pension information, although the exact impersonated brand has not been confirmed by public page analysis. The combination of recent registration, dedicated hosting, and multiple vendor detections aligns with typical infrastructure used for credential‑harvesting campaigns.

Defenders should update URL filtering rules to block the domain, monitor DNS queries for the associated IP address, and consider adding the indicator to internal threat intelligence feeds. Security teams should also verify email gateways for references to this domain, enforce multi‑factor authentication for any credentials potentially targeted, and isolate any compromised accounts that may have interacted with the site.