gov[.]uk-dwplsu[.]icu

On 29 July 2026 the domain gov.uk-dwplsu.icu was observed as active in a generic phishing campaign. The domain was registered on 12 June 2026 through Aceville Pte. Ltd., a registrar that has been associated with other malicious infrastructure. Automated analysis on VirusTotal shows that 10 of 91 security vendors submitted a malicious verdict for the domain, indicating a non‑trivial detection rate.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that upstream filters are already treating it as hostile. No additional public intelligence, such as Safe Browsing entries, OTX mentions, ASN or hosting IP details, SSL certificate information, or HTTP response codes, is currently available for this indicator. The observable evidence therefore confirms the presence of a phishing‑related infrastructure that is actively being used.

The limited detection count suggests that some scanners have not yet identified the payload, which may allow the campaign to evade less‑rigorous controls. Defenders should proactively add gov.uk-dwplsu.icu to local deny lists, ensure that network perimeter solutions reference the PhishDestroy blocklist, and monitor for any new detections from additional scanning engines. Continuous re‑evaluation is advised, as further attributes such as hosting location, page content, or associated command‑and‑control endpoints may emerge as the investigation proceeds.