uk[.]paying-gm[.]vip

Analysis of uk.paying-gm.vip indicates that the domain was registered on 16 December 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina. The authoritative nameservers dns19.hichina.com and dns20.hichina.com resolve the host to the IPv6 address 2a04:4e42:200::144, which is announced by AS54113 Fastly, Inc. in the United States. No TLS certificate was observed, meaning the site operated over plain HTTP only. The page title returned by the server is “Welcome to GOV.UK”, suggesting an attempt to impersonate the official UK government portal, although the page content has not been captured for further analysis.

Security telemetry shows that 16 of 95 vendors on VirusTotal flagged the domain as malicious, and PhishDestroy listed it as blocked. It also appears on a single external blocklist, and the Gridinsoft trust engine assigned a score of 0 out of 100. The current operational status is offline, and the domain is no longer reachable. Given the combination of registrar choice, Fastly hosting, lack of encryption, hostile detections, and the GOV.UK‑styled title, the infrastructure aligns with known generic phishing campaigns targeting UK citizens.

Defenders should add the domain and its IPv6 host to network deny lists, monitor for any re‑registration or DNS changes, and ensure that any outbound traffic to Fastly edge nodes associated with this address is inspected. Because the site is already offline, immediate mitigation focuses on preventing re‑use of the same infrastructure. Continuous monitoring of the registrar’s name‑server space and periodic re‑scans for new detections are recommended.