uk[.]paying-dq[.]vip

This domain, uk.paying-dq.vip, is identified as a generic phishing infrastructure specifically designed to mimic the official GOV.UK portal. Analysis of the page title, 'Welcome to GOV.UK,' confirms the intent to deceive users into believing they are interacting with legitimate UK government services. The domain shows no evidence of hosting a cryptocurrency drainer kit but is structured for credential harvesting, likely targeting UK citizens through fraudulent tax, benefits, or official documentation scams. No SSL certificate is present, increasing the risk of interception or further malicious redirection. Infrastructure analysis reveals the domain was registered on December 15, 2025, through Alibaba Cloud Computing Ltd. (HiChina), a registrar frequently exploited for phishing operations. It resolves to IP address 151.101.192.144, hosted on AS54113 (Fastly, Inc.) in the United States, despite its UK-themed branding. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of analysis, though this may reflect a lag in detection rather than absence of risk. The domain is currently offline, likely following takedown actions or abandonment by the threat actor. However, the infrastructure remains a residual risk due to the recent registration date and the potential for reactivation or migration to a newly registered domain. Users who interacted with uk.paying-dq.vip should assume credential exposure and initiate password resets on any accounts accessed during the exposure window. Organizations are advised to monitor for related domains using the 'paying-dq' subdomain pattern or similar UK government-themed impersonation tactics. Proactive DNS sinkholing and endpoint detection rules targeting the resolved IP (151.101.192.144) are recommended to mitigate further exploitation.