uk[.]paying-gj[.]vip

Analysis of uk.paying-gj.vip indicates that the domain is being used for a generic phishing campaign targeting users of the UK government portal. The domain was registered on 16 December 2025 through Alibaba Cloud Computing Ltd., operating under the HiChina registrar (www.net.cn). Its authoritative name servers are dns13.hichina.com and dns14.hichina.com, which are typical of domains hosted on the HiChina platform. No TLS certificate is present, and HTTP requests return an offline status, confirming that the site is no longer reachable. Network resolution points to the IP address 151.101.128.144, which belongs to the Fastly content delivery network (ASN 54113) and is geolocated in the United States.

Fastly is a commonly abused CDN for transient phishing infrastructure. The IP appears on a single security blocklist, and the domain itself is listed by PhishDestroy. VirusTotal scans show that 14 out of 95 antivirus and URL scanning engines flagged the domain, reinforcing the malicious assessment. The Gridinsoft trust score of 0 out of 100 further reflects an extremely low reputation. The page title returned from the site is “Welcome to GOV.UK”, matching the typical lure used in phishing attempts that impersonate official UK government services.

No additional page content, SSL validation, or redirection details are available because the site is offline, leaving the exact payload unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address within Fastly, and add the domain to internal blocklists. Ongoing threat intelligence feeds should be consulted for any new indicators that might associate the domain with larger phishing kits or campaigns. Until the site is taken down permanently, the combination of registrar, CDN hosting, low trust score, and multiple vendor detections suggests a high likelihood of malicious intent.