uk[.]paying-js[.]vip

The domain uk.paying-js.vip was registered on 16 December 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina. Its authoritative name servers are dns7.hichina.com and dns8.hichina.com, indicating continued use of the HiChina DNS infrastructure. DNS resolution points to the address 151.101.0.144, which belongs to the Fastly content‑delivery network (ASN 54113) located in the United States. No TLS certificate was observed; the site served only HTTP, which is consistent with the lack of an SSL binding in the scan data. Public sandbox analysis on VirusTotal recorded 14 positive detections out of 95 scanned security vendors, confirming that the domain is recognized as malicious by multiple anti‑malware engines.

The domain also appears on a single external blocklist and has been explicitly flagged by the PhishDestroy feed, reinforcing its reputation as a phishing vector. Gridinsoft’s proprietary trust scoring assigned a rating of 0 out of 100, the lowest possible confidence in legitimacy. The only content retrieved before takedown was the page title “Welcome to GOV.UK”, a likely indicator that the site attempted to masquerade as an official UK government portal. No further page elements, forms, or credential‑capture mechanisms have been disclosed in the available data, so the exact lure employed remains unverified.

At the time of reporting (23 July 2026) the host is offline, which may be the result of takedown actions or temporary disruption. Nevertheless, the infrastructure components—including the Fastly edge IP, the HiChina name servers, and the registrar details—remain observable and should be added to defensive controls. Organizations are advised to block uk.paying-js.vip at the network perimeter, update URL filtering lists, and monitor for any future resolution to the same IP range or registrar. Continuous re‑evaluation of threat intelligence feeds for re‑appearance is recommended.