gov[.]uk-dwpme[.]icu

gov.uk-dwpme.icu was registered on 12 June 2026 through Aceville Pte. Ltd. The domain has been observed in a limited set of threat‑intel feeds; it appears on one security blocklist and is currently listed by the PhishDestroy sinkhole as malicious. VirusTotal analysis shows that six of ninety‑one scanning engines returned a positive detection, confirming that at least a subset of commercial scanners consider the domain to be malicious. The limited number of detections suggests the payload or hosting may be recent or configured to evade broader detection, but the presence of multiple independent detections indicates a non‑trivial threat.

No additional data such as IP address, hosting ASN, SSL details, or page title have been released publicly, leaving the full infrastructure and landing page content unknown. Consequently, defenders cannot attribute the domain to a specific phishing kit or verify the exact victim‑targeting technique. The combination of recent creation, a privacy‑light registrar, inclusion on a known phishing blocklist, and multiple vendor detections warrants an elevated risk rating.

Organizations should add the domain to their deny lists, enforce URL filtering for .icu TLDs that reference UK government services, and monitor outbound DNS queries for related resolution patterns. Continuous re‑scanning on VirusTotal and periodic checks of blocklist feeds are recommended to capture any changes in detection status. Until further forensic evidence is released, the domain should be treated as actively malicious and blocked at network perimeter and endpoint layers.