uk[.]paying-ji[.]vip

This domain uk.paying-ji.vip was registered on 16 December 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina and is served by the authoritative name servers dns17.hichina.com and dns18.hichina.com. The domain resolves to the IPv6 address 2a04:4e42:200::144, which is announced by AS54113 belonging to Fastly, Inc. and geo‑located in the United States. No TLS certificate is present, indicating that the site is delivered over plain HTTP only. The page title returned from the host is “Welcome to GOV.UK”, a clear indicator of an attempt to masquerade as a legitimate government portal. Threat intelligence platforms have flagged the domain: thirteen of ninety‑five VirusTotal scanners reported it as malicious, Gridinsoft assigned a trust score of zero out of one hundred, and it is listed on a single external blocklist.

The phishing‑specific blocking service PhishDestroy has already taken the site offline, and the current status is recorded as offline. Analysis confirms that the infrastructure components—registrar, DNS provider, hosting network, and lack of encryption—are consistent with a recent generic phishing campaign targeting users who might trust a .gov‑style title. The absence of an SSL certificate reduces the likelihood of credential capture via HTTPS, but the plain‑text delivery still permits credential harvesting or redirecting victims to malicious payloads. The IPv6 address is hosted on a content‑delivery network that is frequently abused for fast‑flux or short‑lived phishing sites, so future re‑hosting of the same domain or similar domains on the same address range is possible. Defenders should add uk.paying-ji.vip to internal URL blocklists and ensure that DNS resolvers block both the domain name and its associated IPv6 address.

Network monitoring rules should be created to alert on any traffic to 2a04:4e42:200::144. Email security gateways should be updated to flag messages that reference “GOV.UK” or contain links to this domain.