gov[.]uk-dwplix[.]icu

Analysis of gov.uk-dwplix.icu indicates an active phishing domain targeting UK government services, registered on June 12, 2026, through Aceville Pte. Ltd. The domain is currently flagged by 12 of 91 security vendors on VirusTotal, with PhishDestroy listing it on its blocklist as of the latest scan. Infrastructure review shows the domain was created recently, aligning with common phishing campaign timelines where newly registered domains are leveraged to evade reputation-based defenses. No associated IP, hosting provider, or SSL certificate details are currently available in public threat feeds, limiting attribution to specific infrastructure.

The domain's naming convention—combining 'gov.uk' with a non-standard suffix—suggests an attempt to mimic legitimate UK government portals, though the exact content or targeted brand remains unconfirmed due to lack of page title or kit analysis. Defenders should treat this domain as elevated risk, particularly for organizations or users interacting with UK public sector services.

Recommended actions include blocking the domain at the DNS or proxy level, monitoring for related indicators of compromise, and alerting end-users to potential credential harvesting or malware distribution risks. Further investigation into the domain's hosting and traffic patterns is advised to determine the full scope of the campaign.