gov[.]uk-dwpliy[.]icu

The domain gov.uk-dwpliy.icu was registered on June 12 2026 through Aceville Pte. Ltd. and is currently classified as a high‑risk generic phishing infrastructure. VirusTotal analysis shows that 14 of 91 scanned security vendors have flagged the domain, indicating a notable detection rate across multiple engines. Google Safe Browsing also marks the domain for social engineering, and the domain appears on a single external blocklist. Network resolution points to the IPv4 address 43.130.72.207, which is the sole host observed for this indicator. The domain is actively blocked by the PhishDestroy mitigation service, confirming that at least one commercial sinkhole is already enforcing a deny rule.

Evidence suggests the domain is being used to lure victims into credential‑theft flows, although the exact payload or landing page content has not been publicly disclosed. No additional intelligence such as SSL certificates, HTTP response codes, or page titles is available at this time, leaving the precise attack vector and targeted audience uncertain. The presence of multiple vendor detections and a Google Safe Browsing flag, combined with the recent registration date, supports the high‑risk rating. Defenders should immediately add gov.uk-dwpliy.icu to URL filtering and DNS block lists across enterprise perimeter and endpoint controls.

The associated IP address 43.130.72.207 should be added to network‑level deny lists, and traffic to that host should be monitored for anomalous outbound connections. Continuous re‑scanning on VirusTotal and periodic checks of Google Safe Browsing are recommended to capture any changes in detection status. Organizations employing email security gateways should ensure that messages containing this domain are quarantined or rejected. Finally, threat‑intel teams should track any future sightings of the registrar Aceville Pte. Ltd. and the hosting IP to identify potential expansion of the campaign.