gov[.]uk-dwpli[.]icu

Analysis of the domain gov.uk-dwpli.icu indicates that it is actively being used for phishing. The domain was registered on 12 June 2026 through Aceville Pte. Ltd., a registrar that has been observed in other malicious campaigns. The authoritative name records resolve the domain to the single IPv4 address 43.130.77.130.

That IP currently appears on one public security blocklist and has been flagged by the PhishDestroy sink‑hole service, confirming operational use in malicious email or web‑based campaigns. VirusTotal scans show that 16 out of 91 security vendors label the domain as malicious, providing independent corroboration of its risk profile. No additional public intelligence such as Google Safe Browsing, Open Threat Exchange, SSL certificate details, HTTP response codes, or page title information is presently available, leaving the full surface‑area characteristics of the hosting infrastructure undocumented.

Based on the available evidence, defenders should treat the domain as hostile: it should be added to outbound and inbound deny lists, its IP address 43.130.77.130 should be blocked at the network perimeter, and any traffic that resolves to this host should be logged and investigated. Continuous monitoring of the registrar Aceville Pte. Ltd. for newly created domains is advisable, as is periodic re‑query of threat‑intel platforms for updates on blocklist status or additional vendor detections. Until further context is gathered, the domain remains classified as an elevated‑risk phishing resource.