gov[.]uk-dwplin[.]icu

Analysis of the domain gov.uk-dwplin.icu indicates it is actively involved in phishing operations targeting UK government services. The domain was registered on June 12, 2026, through Aceville Pte. Ltd., a registrar frequently associated with abusive registrations. It currently resolves to the IP address 43.130.72.207, which has been linked to other malicious infrastructure in recent threat intelligence reports.

As of July 29, 2026, the domain appears on one security blocklist and is flagged by 15 of 91 security vendors on VirusTotal, confirming its detection as malicious by multiple independent sources. No additional context regarding the specific phishing kit, brand impersonation, or page content is available at this time, though the domain name suggests an intent to mimic official UK government communications.

Defenders are advised to block this domain at the DNS and proxy levels, monitor for related subdomains or newly registered lookalike domains, and review logs for connections to 43.130.72.207. Given the elevated risk classification and active status, organizations should treat this domain as hostile until further analysis confirms its takedown or remediation.