gov[.]uk-dwpcat[.]icu

The domain gov.uk-dwpcat.icu was registered on June 12 2026 through the registrar Aceville Pte. Ltd. Google Safe Browsing has classified it as a social engineering threat, and the domain appears on a single security blocklist. Network resolution points to IP address 43.130.72.207, which is currently the only known hosting endpoint. The domain has been flagged by the PhishDestroy sinkhole and is listed by at least one external blocklist. VirusTotal analysis shows that 16 of 91 scanned security vendors assign a malicious verdict to the domain, indicating a non‑trivial detection rate across independent scanners.

The limited blocklist presence and the relatively recent registration suggest that the infrastructure may be in early deployment stages, but the consistent detection by multiple vendors confirms malicious intent. Uncertainties remain regarding the full scope of the phishing campaign, the specific victim targeting, and any additional hosting or command‑and‑control infrastructure that may be employed. Defenders should add the domain to internal blocklists, monitor DNS queries to 43.130.72.207, and enforce Google Safe Browsing checks where possible. Network traffic to the domain should be logged and, if observed, terminated.

Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any changes in detection scores. Organizations using email filters should ensure that messages containing URLs to this domain are quarantined or discarded. Incident response teams should treat any credential submissions to the domain as compromised and initiate appropriate user notification and credential reset procedures.