gov[.]uk-dwpily[.]icu

Analysis of the domain gov.uk-dwpily.icu indicates it is an active phishing infrastructure targeting UK government services, specifically the Department for Work and Pensions (DWP). Registered on June 12, 2026, through Aceville Pte. Ltd., the domain resolves to the IP address 43.130.72.207. As of July 29, 2026, 14 of 91 security vendors on VirusTotal have flagged this domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. Google Safe Browsing categorizes the site as engaging in social engineering, a common tactic for credential harvesting or personal data theft.

The domain name incorporates 'gov.uk' and 'dwp', suggesting an intent to impersonate official UK government communications related to benefits or welfare services. However, the exact content and functionality of the site remain unverified, as no page title, phishing kit, or brand-specific artifacts have been confirmed in the available data. The use of a newly registered domain (under two months old) with a deceptive name structure aligns with typical phishing campaign tactics to evade detection and exploit trust in government branding. Defenders should treat this domain as high-risk infrastructure.

Network-level blocking of the domain and its resolving IP (43.130.72.207) is recommended to prevent potential credential theft or fraud. Organizations handling UK benefits data or serving affected populations should monitor for connections to this domain and investigate any associated activity. Further analysis of the site's content, if accessible, could provide additional indicators of compromise, such as phishing kit signatures or exfiltration endpoints. No evidence currently links this domain to broader campaign infrastructure or threat actor groups.