uk[.]paying-vd[.]vip

The domain uk.paying-vd.vip was registered on 21 February 2026 and is presently taken offline. Active scans recorded a page title of "Pay a parking fine," which aligns with a banking‑phishing narrative targeting victims with a fake parking‑fine payment request. The site resolves to IP address 170.106.159.17, located in the United States and associated with AS132203, a Tencent‑owned network segment on Kejizhongyi Avenue. Security aggregators have flagged the domain: 13 of 95 VirusTotal scanners reported malicious activity, and it appears on a single external blocklist.

Independent reputation services assign extremely low trust scores—Scamadviser rates it 1/100 and Gridinsoft 0/100—indicating a high likelihood of fraud. The SSL certificate is classified as grade E7, reflecting weak encryption or misconfiguration, which further diminishes credibility. PhishDestroy has already blocked the domain, confirming its malicious intent.

While the exact phishing kit or credential‑harvesting mechanism has not been disclosed, the convergence of low trust scores, multiple vendor detections, and the parking‑fine lure suggests a classic credential‑theft campaign aimed at extracting payment details from unsuspecting users. Defenders should immediately add the IP 170.106.159.17 to network deny lists, enforce DNS filtering for uk.paying-vd.vip, and monitor outbound connections to the Tencent AS for any residual activity. Continuous threat‑intel feeds should be consulted for potential re‑hosting attempts, and endpoint security solutions should be updated to include the 13 vendor detection signatures associated with this domain.