gov[.]uk-dwplz[.]icu

Analysis of the domain gov.uk-dwplz.icu indicates that it is actively used for a generic phishing campaign. The domain was registered on June 12, 2026 through the registrar Aceville Pte. Ltd. and first appeared on a security blocklist shortly after creation, currently listing one blocklist entry. Independent scanning on VirusTotal shows that 14 of 91 security vendors have flagged the domain as malicious, confirming a consensus of suspicion among the majority of commercial engines. The domain is also listed by the PhishDestroy blocklist, which has taken explicit action to block it.

No additional intelligence such as hosting IP, SSL certificate details, Safe Browsing verdicts, or page title information is presently available, leaving the underlying infrastructure uncharacterized. The limited visibility suggests that the threat actors may be employing fast‑flux or short‑lived hosting, a common tactic for phishing sites. Defenders should immediately add gov.uk-dwplz.icu to outbound and inbound deny lists, monitor DNS queries for the domain, and continue periodic re‑scanning to capture any changes in vendor detections.

Since the domain is less than two months old, it is likely to be used in targeted credential‑harvesting emails that masquerade as UK government communications. Organizations should reinforce user education on verifying URLs, especially those with irregular TLDs such as .icu, and enforce multi‑factor authentication to mitigate credential compromise. Ongoing threat‑intel feeds should be consulted for any new blocklist additions or detection updates related to this domain.