uk[.]paying-gn[.]vip

Analysis of the domain uk.paying-gn.vip shows it was registered on December 16 2025 via Alibaba Cloud Computing Ltd. d/b/a HiChina. The authoritative nameservers are dns21.hichina.com and dns22.hichina.com. The domain resolves to the IPv6 address 2a04:4e42::144, which is announced by AS54113 belonging to Fastly, Inc., located in the United States. No TLS certificate is presented, indicating HTTP only. The page title returned from the host is "Welcome to GOV.UK", suggesting an attempt to impersonate the official UK government portal. VirusTotal scans have flagged the domain by 15 of 95 security vendors, indicating a moderate detection consensus.

Gridinsoft’s trust scoring system assigns a score of 0 out of 100, reinforcing the malicious classification. The domain is listed on at least one security blocklist and was actively blocked by the PhishDestroy service. The infrastructure appears to have been taken offline at the time of reporting. Uncertainties remain regarding the specific phishing kit or credential collection mechanism employed, as no further page content has been captured. The lack of an SSL certificate may be a deliberate choice to avoid certificate procurement costs or to exploit HTTP‑only trust models.

The use of Fastly’s network could indicate reliance on a CDN for rapid deployment or to mask the true origin of the malicious server. No evidence of additional IP addresses, sub‑domains, or related infrastructure has been observed. Defenders should add uk.paying-gn.vip to deny‑list and URL filtering policies, monitor for any future resolution to the same Fastly‑owned IPv6 prefix, and consider enforcing HTTPS‑only and HSTS for government‑related traffic. Organizations that routinely interact with GOV.UK should alert users to the lack of TLS on the reported host and educate them on verifying the legitimate GOV.UK URL and certificate chain. Continuous re‑scanning of the domain through multi‑vendor services is recommended in case the site resurfaces.