uk[.]paying-jo[.]vip

Analysis of uk.paying-jo.vip shows a newly created domain (registered on December 16, 2025) that targets the UK government brand, as evidenced by the page title "Welcome to GOV.UK" retrieved before the site was taken offline. The domain is registered through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and uses the authoritative nameservers dns29.hichina.com and dns30.hichina.com. Network resolution points to the IPv6 address 2a04:4e42:200::144, which is announced by AS54113 Fastly, Inc. and geolocated to the United States. No TLS certificate was observed, indicating that any communication would be unencrypted.

Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded 11 detections out of 95 scanning engines, reinforcing the malicious assessment. Current status is offline, so real‑time HTTP response codes or payloads are unavailable, limiting deeper content analysis.

Uncertainty remains around the full scope of the phishing kit and any additional infrastructure that may be leveraged if the site is reactivated. Defenders should immediately block the domain name and its IPv6 address at perimeter defenses, incorporate the PhishDestroy blocklist entry into web filtering solutions, and monitor the Fastly CDN range for any future activity originating from the same address. Coordination with the registrar (Alibaba Cloud Computing Ltd.) is advised to request takedown and prevent further abuse. Continuous threat‑intel feeds should be consulted for any new detections linked to this indicator.