# PhishDestroy domain threat record: uklicence.co.uk Content language: English Canonical HTML report: https://phishdestroy.io/domain/uklicence.co.uk/ Machine-readable companion: https://phishdestroy.io/domain/uklicence.co.uk/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-16 01:37:54 UTC - Last availability or vendor check: 2026-10-22 22:36:36 UTC - Stored record updated: 2026-10-22 22:36:36 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: whatsapp ## Stored infrastructure - Observed IP address: 208.116.17.8 - Registrar in stored WHOIS data: Verpex Ltd - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-04-01 15:12:38 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1425c-4811-763e-a717-e543f2a047d3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/uklicence.co.uk - Certificate Transparency search: https://crt.sh/?q=%25.uklicence.co.uk - Web Archive lookup: https://web.archive.org/web/*/https://uklicence.co.uk/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview uklicence.co.uk is an impersonation phishing page that presents itself as a UK licence service under the title "UK Licence - UK Licence". It targets people in the UK who are looking to apply for, renew or manage a licence and who might mistake it for an official or legitimate channel. PhishDestroy first saw the domain on 2026-10-16. As of 2026-10-19 the site is still online and serving live content. How the scam works Impersonation sites of this kind copy the name and look of a trusted licensing service so that visitors believe they are dealing with the real thing. The victim is typically guided through what looks like an application or renewal form that asks for full name, date of birth, address, licence or identity numbers, and often scans of identity documents. Many such pages also request a card payment for a supposed processing fee, which is either far above the genuine cost or delivers no service at all. The result is direct financial loss plus a package of personal data that can be reused for identity fraud or follow-up scams. Evidence On VirusTotal, 3 of 92 engines flag the domain as of 2026-10-19: CRDF, Forcepoint ThreatSeeker and VIPRE. That is a low detection count, so many security tools and browsers may not yet warn visitors. The domain is listed on the PhishDestroy blocklist. Infrastructure The domain was registered on 2026-04-01 through Verpex Ltd, about six months before PhishDestroy detected it. It resolves to 208.116.17.8 on the WHG-AUS network of WHG Hosting Services Ltd, a GB-registered provider, with the address located in Australia. The site uses a TLS certificate issued by Let's Encrypt (YR2), so the padlock in the browser says nothing about whether the site is legitimate. What to do If you only browsed the site, close it and use the official government or licensing authority channels directly. If you entered card details, contact your bank immediately to block the card and dispute the charge. If you submitted identity information or documents, watch for misuse, consider placing a fraud alert with a credit reference agency, and treat any follow-up calls, texts or emails about your application with suspicion. Defenders should block uklicence.co.uk and 208.116.17.8 at DNS, proxy and email gateways, and report the site to the registrar and hosting provider through their abuse channels. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1425c-4811-763e-a717-e543f2a047d3/ VirusTotal report: https://www.virustotal.com/gui/domain/uklicence.co.uk Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=uklicence.co.uk Archived copy: https://web.archive.org/web/20261016013948/https://uklicence.co.uk/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:22:27 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1425c-4811-763e-a717-e543f2a047d3.png Captured: 2026-10-16 01:37:54 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1425c-4811-763e-a717-e543f2a047d3.png Captured: 2026-10-16 03:30:21 UTC Source report: https://urlscan.io/result/01a1425c-4811-763e-a717-e543f2a047d3/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3615829f-064e-40ee-acb7-ca3f948a5d77.png Captured: 2026-10-16 01:50:16 UTC Source report: https://radar.cloudflare.com/scan/3615829f-064e-40ee-acb7-ca3f948a5d77 SHA-256: afe85ca5c607804ca4a8874906886787afd4a41fedc138b5a65b6792bbb7879c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:46:07Z", "uuid": "01a1425c-4811-763e-a717-e543f2a047d3", "scanned_at": "2026-10-16T01:38:35Z", "final_url": "https://uklicence.co.uk/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://uklicence.co.uk/", "from": "http://uklicence.co.uk/", "status": 307 } ], "ip": "208.116.17.8", "ptr": "208-116-17-8.my-reverse-dns.com", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com", "bootstrap.smartsuppchat.com", "i0.wp.com", "www.smartsuppchat.com", "challenges.cloudflare.com" ], "ips": [ "18.158.109.57", "192.0.77.2", "95.173.204.18", "104.18.95.41", "142.250.207.3", "142.251.42.106", "208.116.17.8" ], "asns": [ "16509", "2635", "60068", "13335", "15169", "216180" ], "countries": [ "DE", "US", "JP", "AU" ], "link_domains": [ "www.autoexpress.co.uk", "www.gov.uk", "validukdocuments.com", "www.quora.com", "www.mib.org.uk", "gov.uk", "join.chat" ], "doc_hash": "8b175ba638a79bbf939a7082fc7b8d8580f96068ecb789039c741ff16ea79af9", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "d151f8c0b2659cfb63704d68654ad8d9437ae9da4410536f63ddec21689a0620", "fca8dd4ee9c93f33dc3149e2c78aec8a28c54036faaf19c7b0ac9ca32293c070", "8b083f64f2e9e8ac445c730dfce7013cc6449ce155fd1c2f42b60edba4ecb4b1", "17daa5f5929c3deab38ffaacd89b213810e35e7d3ee115fc890b6bfdc230a9ad", "61ccb2ff314af4b300014f1715b9e9b29f6aede9f25151e00722d5a4455c0ff2", "900f2dd9f6b66295a51f90c15a9271145b7964d8032725b4647ac44b409ceffa", "5a1d08f003cc8da23a338891305aa6eeaa3d61250b61e214d43874c6689756e9", "2137c4e292448183917a4ede265d546ab578e8ebd600b9922c44ac08f02c92f5" ], "globals": [ "jQuery", "wc_add_to_cart_params", "woocommerce_params", "_", "_wpUtilSettings", "wp", "wc_add_to_cart_variation_params", "wc_cart_fragments_params", "_smartsupp", "smartsupp", "EvEmitter", "imagesLoaded", "oceanwpLocalize", "oceanwp", "jQueryBridget", "getSize", "matchesSelector", "fizzyUIUtils", "Flickity", "Unipointer", "Unidragger", "oceanwpWooCustomFeatures", "webpackChunkelementorFrontend", "elementorModules", "PremiumSettings", "elementorFrontendConfig", "elementorFrontend", "sbjs", "wc_order_attribution", "paElementsHandler", "webpackChunkelementor_pro", "ElementorProFrontendConfig", "elementorProFrontend", "Cookies", "on_keydown_remove_from_cart", "focus_populate_live_region", "refresh_sorted_by_live_region", "on_document_ready", "joinchat_obj", "_wpemojiSettings" ], "cookies": [ "sbjs_migrations", "sbjs_current_add", "sbjs_first_add", "sbjs_current", "sbjs_first", "sbjs_udata", "sbjs_session" ], "storage_keys": [ "elementor", "wc", "test", "wpEmojiSettingsSupports", "wc_fragments_3e2c821a9867feb33ae72b498d6dbdf0", "wc_cart_hash_3e2c821a9867feb33ae72b498d6dbdf0" ], "tls": { "san": [ "autoconfig.crateenginesaustralia.au", "autoconfig.uklicence.co.uk", "autodiscover.crateenginesaustralia.au", "autodiscover.uklicence.co.uk", "cpanel.crateenginesaustralia.au", "cpanel.uklicence.co.uk", "cpcalendars.crateenginesaustralia.au", "cpcalendars.uklicence.co.uk", "cpcontacts.crateenginesaustralia.au", "cpcontacts.uklicence.co.uk" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "cpanel.uklicence.co.uk", "protocol": "TLS 1.3", "valid_to": "2026-12-15T03:46:28Z", "valid_from": "2026-09-16T03:46:29Z" }, "domain_age_days": 2257, "apex_age_days": 2257, "tls_age_days": 29, "tls_valid_days": 89, "requests": 90, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 14, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:59:22Z", "uuid": "3615829f-064e-40ee-acb7-ca3f948a5d77", "scanned_at": "2026-10-16T01:50:16Z", "final_url": "https://uklicence.co.uk/", "status": 200, "history": [ { "url": "https://uklicence.co.uk/", "status": 200 } ], "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331", "doc_hash": "9d1bec6080fbefc8b22070e148c5ac5a5bd1ad9d0a75e97b58ce9b914ab92af4", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "uklicence.co.uk", "type": "A", "value": "208.116.17.8" } ], "dnssec_valid": false, "ip": "208.116.17.8", "whois": { "registrar": "Verpex Ltd [Tag = VERPEX]", "created": "2026-04-01T00:00:00Z", "updated": "2026-07-16T00:00:00Z", "expires": "2027-04-01T00:00:00Z", "nameservers": [ "ns1.mysecurecloudhost.com", "ns2.mysecurecloudhost.com", "ns3.mysecurecloudhost.com", "ns4.mysecurecloudhost.com", "ns5.mysecurecloudhost.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T19:45:40Z", "analysis_at": "2026-10-19T16:25:08Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 3, "suspicious": 0, "undetected": 35 }, "detections": { "CRDF": "malicious", "VIPRE": "malware", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-04-01T18:39:37Z", "dns": [ { "ttl": 7200, "type": "A", "value": "208.116.17.8" }, { "ttl": 21600, "type": "NS", "value": "ns3.mysecurecloudhost.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.mysecurecloudhost.com" }, { "ttl": 21600, "type": "SOA", "rname": "servers.mysecurecloudhost.com", "value": "ns1.mysecurecloudhost.com" }, { "ttl": 7200, "type": "TXT", "value": "v=spf1 +a +mx +ip4:208.116.17.5 include:spf.mysecurecloudhost.com ~all" }, { "ttl": 21600, "type": "NS", "value": "ns4.mysecurecloudhost.com" }, { "ttl": 7200, "type": "MX", "value": "uklicence.co.uk", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns1.mysecurecloudhost.com" } ], "dns_at": "2026-10-19T16:25:28Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "autoconfig.crateenginesaustralia.au", "autoconfig.uklicence.co.uk", "autodiscover.crateenginesaustralia.au", "autodiscover.uklicence.co.uk", "cpanel.crateenginesaustralia.au", "cpanel.uklicence.co.uk", "cpcalendars.crateenginesaustralia.au", "cpcalendars.uklicence.co.uk", "cpcontacts.crateenginesaustralia.au", "cpcontacts.uklicence.co.uk" ], "issuer": "Let's Encrypt / YR2", "serial": "69f8a2bcdebc6364d2b7dc90218d27a5896", "sha256": "20e0a72071859ad980341abaa998259f2dc51a4cc1ba7ee3356d87cd3a8352d6", "subject": "cpanel.uklicence.co.uk", "valid_to": "2026-12-15T03:46:28Z", "valid_from": "2026-09-16T03:46:29Z" } } } ```