uk[.]paying-lq[.]vip

The domain uk.paying-lq.vip was observed as a generic phishing site targeting UK government users, indicated by the page title “Welcome to GOV.UK”. The domain was registered on December 17, 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and uses the authoritative nameservers dns7.hichina.com and dns8.hichina.com. No TLS certificate was presented, implying the site operated over plain HTTP. Infrastructure analysis shows the domain resolves to the IPv6 address 2a04:4e42:200::144, which belongs to AS54113 Fastly, Inc. located in the United States.

The host is currently offline, and the domain has been taken down. Threat intelligence platforms have flagged the domain; VirusTotal reported 15 detections out of 95 scanned security vendors, and Gridinsoft assigned a trust score of zero out of one hundred. The domain appears on a single security blocklist and was specifically blocked by the PhishDestroy feed. The lack of SSL, low trust score, and the presence of multiple detections are consistent with a malicious phishing operation.

At this time, the content of the site beyond the page title has not been captured, so the exact phishing flow and credential collection mechanisms remain unknown. Defenders should continue to block the domain at DNS and network layers, monitor for any residual traffic to the associated Fastly IP range, and update URL filtering policies to include the observed IPv6 address. Additional monitoring of the registrar’s name servers for new domains using similar patterns is recommended, as the infrastructure may be reused in future campaigns.