gov[.]uk-dwpilr[.]icu

Analysis of the domain gov.uk-dwpilr.icu indicates that it was registered on 12 June 2026 through the registrar Aceville Pte. Ltd. The domain resolves to the IPv4 address 43.130.72.207. Within the VirusTotal ecosystem, fourteen of ninety‑one scanned security vendors have flagged the domain as malicious, suggesting a consensus of concern among a subset of scanners. The domain appears on a single external security blocklist and has been actively blocked by the PhishDestroy mitigation service, reinforcing its classification as a phishing‑related artifact. The threat is labeled as generic phishing with an elevated risk rating and the infrastructure remains active as of the report date.

The assessment assigns an elevated risk level and marks the infrastructure as active, consistent with the reported status. Evidence does not currently include details such as SSL certificate properties, HTTP response codes, page title, or content analysis, so the precise lure or credential‑harvesting mechanism cannot be confirmed. The limited blocklist presence and the partial VirusTotal detections imply that the domain may be in early deployment or that detection signatures are still propagating across scanning platforms. Defenders should add 43.130.72.207 to network‑level deny lists, enforce DNS filtering for gov.uk-dwpilr.icu, and monitor outbound connections to the address.

Continuous re‑scanning of the domain on VirusTotal and inclusion in email gateway phishing filters are recommended. Organizations that rely on UK government services should remain vigilant for unsolicited communications that reference the domain, especially those requesting personal or financial information. For internal tracking, the observation is logged under the seed identifier 4a119a.