gov[.]uk-dwpukv[.]icu

Analysis indicates that the domain gov.uk-dwpukv.icu was registered on 12 June 2026 through Aceville Pte. Ltd. The domain resolves to the IPv4 address 43.130.72.207. It is currently listed on a security blocklist and has been actively blocked by the PhishDestroy service. Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports that 15 of 91 scanned security vendors flag the domain as malicious. The limited detection footprint suggests a recent deployment, consistent with the creation date.

No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, indicating that detailed content analysis has not yet been published. The presence on a single blocklist and the moderate number of VirusTotal detections imply that the infrastructure is being monitored but may not yet be widely disseminated. Defenders should add 43.130.72.207 to network deny lists, enforce DNS filtering for the domain, and monitor outbound traffic for connections to the address. Continuous re‑scanning of the domain through VirusTotal and similar platforms is advised to capture any escalation in detection rates.

Organizations using email filters should ensure that any messages referencing UK government or DWP services that contain links to this domain are quarantined. Since the registrar is known, investigators may request WHOIS and registration records to confirm the ownership details. Until further forensic evidence is released, the domain should be treated as a high‑risk generic phishing vector and blocked at perimeter and endpoint layers.