gov[.]uk-wk[.]icu

Analysis indicates that the domain gov.uk-wk.icu was registered on June 12, 2026 through the registrar Aceville Pte. Ltd. The domain is currently classified as an active generic phishing infrastructure with an elevated risk rating. VirusTotal records show that 16 of 91 security vendors have flagged the domain, demonstrating a moderate level of detection across multiple scanning engines. Independent threat‑blocking services have already listed the domain; PhishDestroy actively blocks it, and it appears on one external security blocklist.

No publicly available evidence has been provided regarding the underlying hosting provider, IP address allocation, SSL certificate details, HTTP response codes, or Safe Browsing status, leaving those aspects of the infrastructure unverified at this time. Likewise, page‑title data, brand impersonation details, and any observed malicious payloads have not been disclosed, so the exact phishing lure remains unknown. Defenders should treat the domain as hostile and enforce blocking at the network perimeter, DNS, and endpoint layers.

Continuous monitoring of DNS queries for gov.uk-wk.icu and related subdomains is advised, along with periodic re‑scanning to capture any changes in payload or hosting. Organizations using URL filtering should add the domain to whitelist‑negative lists, and security teams should alert users to the presence of this credential‑harvesting site, especially given its recent creation and active detection by multiple vendors.