# PhishDestroy threat dossier — gov.uk-dwpliu.icu ================================================================ Fetched: 2026-07-16 01:29:39 UTC Canonical: https://phishdestroy.io/domain/gov.uk-dwpliu.icu/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 14/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, LevelBlue, Lionic, SOCRadar, Sophos, Webroot Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- Registered: 2026-06-12 HTTP response: 502 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-12 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-12 22:30:46 UTC (by PhishDestroy tracker) First reported: 2026-06-15 00:27:29 UTC (abuse notice filed) Last verified: 2026-07-16 00:20:45 UTC Neutralised: 2026-06-13 08:57:42 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 22:06:47 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to harvest credentials by impersonating UK government services. Analysis indicates the domain gov.uk-dwpliu.icu was created on June 12, 2026, a future date suggesting potential typosquatting or domain spoofing tactics. Infrastructure analysis reveals the domain is currently offline but was previously detected by 14 out of 95 security vendors on VirusTotal, indicating moderate-to-high confidence in its malicious nature. It appears on two security blocklists, including entries from PhishDestroy and PhishingDB, further validating its classification as a phishing threat. Technical indicators associated with this domain include its creation date, which deviates from standard registration timelines, raising suspicions of automated or bulk domain generation for malicious campaigns. The domain’s detection ratio of 14/95 on VirusTotal suggests it employs evasion techniques to avoid widespread detection, though it remains flagged by specialized phishing detection systems. No associated IP address or registrar details were provided in the available data, limiting further infrastructure analysis. However, the presence on two blocklists confirms its active use in phishing operations prior to being taken offline. Mitigation steps for this threat type involve proactive monitoring and blocking of the domain across all network security layers. Organizations should update their web filtering rules to explicitly deny access to gov.uk-dwpliu.icu and any subdomains or related URLs. Endpoint protection systems should be configured to flag or quarantine any attempts to access this domain, even if it is currently offline, as it may resurface under altered infrastructure. Security teams are advised to conduct retrospective log analysis to identify any prior interactions with this domain and assess potential credential exposure. User awareness training should emphasize the risks of government-themed phishing sites, particularly those using slight variations of legitimate domains, such as the inclusion of random strings like 'dwpliu' in this case. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/gov.uk-dwpliu.icu/ JSON API: https://api.destroy.tools/v1/check?domain=gov.uk-dwpliu.icu Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 179,239 domains (50,762 alive under monitoring, 128,477 confirmed takedowns/dead). Site: https://phishdestroy.io