gov[.]uk-dwplic[.]icu

Analysis of the domain gov.uk-dwplic.icu indicates that it was registered on June 12, 2026 through the registrar Aceville Pte. Ltd. The domain currently resolves to the IPv4 address 43.130.72.207. VirusTotal reports that 14 of 91 scanned security vendors have flagged the domain as malicious, which aligns with its classification as a generic phishing site. The domain has been added to at least one external security blocklist and is actively blocked by the PhishDestroy mitigation service. The threat is rated elevated and the indicator remains active as of the report date, July 29, 2026.

The available intelligence does not include SSL certificate details, HTTP response codes, Safe Browsing verdicts, or additional reputation scores, and no public page title or content analysis has been released. Consequently, the full scope of the phishing campaign—such as the specific credential‑harvesting technique or targeted brand—is not yet determined. Nonetheless, the convergence of registrar information, hosting IP, and multi‑vendor detections provides sufficient confidence to treat the domain as hostile.

Defenders are advised to deny outbound connections to 43.130.72.207, add gov.uk-dwplic.icu to DNS and proxy blocklists, and monitor network logs for any residual traffic to the host. Continuous re‑query of VirusTotal and blocklist feeds is recommended to capture any changes in detection coverage. Integration of the indicator into existing SIEM correlation rules will help surface potential exploitation attempts targeting users who may receive phishing messages that reference the domain.