uk[.]paying-jf[.]vip

Analysis of uk.paying-jf.vip indicates that the domain is being used for a generic phishing campaign targeting users of the UK government portal, as evidenced by the page title "Welcome to GOV.UK" returned when the site was reachable. The domain resolves to the IP address 151.101.128.144, which belongs to AS54113 Fastly, Inc., a content delivery network located in the United States. Registration details show the domain was created on December 16, 2025 and is listed under Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn). Its authoritative nameservers are dns11.hichina.com and dns12.hichina.com.

No SSL certificate is present, meaning the site operated over HTTP only, a common characteristic of low‑effort phishing infrastructure. VirusTotal scans recorded 12 detections out of 95 security vendors, confirming malicious classification across multiple anti‑malware engines. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

Current operational status is offline, and the site is no longer serving content, but the infrastructure elements remain observable. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated Fastly IP for any re‑use, and incorporate the domain’s indicator set—creation date, registrar, nameservers, and detection count—into threat‑intel feeds. Ongoing vigilance is recommended because the hosting provider may host additional phishing sites that could be activated in the future.