gov[.]uk-dwplir[.]icu

Analysis of gov.uk-dwplir.icu reveals a confirmed phishing domain targeting users with a UK government-themed lure. The domain was registered on June 12, 2026, through Aceville Pte. Ltd., a registrar frequently associated with high-risk registrations. As of July 29, 2026, the domain resolves to the IP address 43.130.72.207, which is hosted on infrastructure previously linked to phishing campaigns. Detection vendors have flagged this domain, with 16 of 91 security engines on VirusTotal identifying it as malicious.

Additionally, the domain appears on at least one security blocklist, specifically PhishDestroy, which categorizes it as an active phishing threat. The infrastructure analysis indicates that the domain is designed to mimic official UK government services, though the exact content and targeting mechanisms remain unconfirmed due to limited public telemetry. The use of 'gov.uk' in the subdomain structure is a deliberate tactic to deceive users into believing the site is legitimate. Defenders should treat this domain as an elevated-risk threat, particularly for organizations or individuals interacting with UK government services.

Immediate blocking at the DNS and network perimeter is recommended, alongside monitoring for any connections to the associated IP address 43.130.72.207. Further investigation into the hosting provider and registrar may yield additional indicators of compromise or related malicious domains. No evidence of SSL certificate abuse or HTTP status anomalies was provided, but defenders should verify these aspects independently if conducting deeper analysis.