gov[.]uk-dwplsb[.]icu

This domain is flagged by 10 of 91 VirusTotal security vendors, indicating a moderate consensus of malicious activity. It is currently blocked by PhishDestroy and appears on one security blocklist. Registered through Aceville Pte. Ltd., the domain was created on June 12, 2026, and resolves to IP address 43.130.72.207.

The domain name incorporates a legitimate UK government subdomain pattern (gov.uk-dwplsb.icu), which is a common tactic in phishing campaigns targeting users of UK government services. The exact content of the hosted page has not been analyzed, but the infrastructure and naming convention suggest a generic phishing operation aimed at credential theft or data harvesting. Defenders should treat this domain as actively hostile and block all outbound traffic to it, as well as monitor logs for any connections to the IP 43.130.72.207.

The domain remains active as of the report date, and given the detection rate and blocklist presence, it poses an elevated risk to organizations with users who may access UK government portals. No additional details on SSL certificate, HTTP status, or page title are available from the known intelligence, so further investigation using sandboxing or manual review is recommended to confirm the specific impersonation target. Security teams should also check internal DNS and proxy logs for any prior interactions with this domain or associated IP range.