uk[.]paying-jp[.]vip

Analysis as of July 24, 2026 indicates that uk.paying-jp.vip is currently offline. The domain was registered on December 16, 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and is served by the authoritative nameservers dns31.hichina.com and dns32.hichina.com. DNS resolution points to the IPv6 address 2a04:4e42:600::144, which belongs to AS54113 Fastly, Inc. and is geolocated to the United States. No TLS certificate was observed, implying that the site either did not serve HTTPS or presented an invalid certificate at the time of testing.

The page title returned from the HTTP response is "Welcome to GOV.UK", a common lure used to impersonate the UK government portal. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans recorded detections from 14 of 95 vendors, confirming malicious classification.

The combination of a freshly created domain, low‑trust scoring, government‑brand page title, and multiple vendor detections aligns with a generic phishing profile targeting UK residents. Uncertainty remains regarding the specific payload or credential‑harvesting mechanism because the site content has not been captured. Defenders should add the domain to inbound and outbound filtering rules, monitor DNS queries for the associated IPv6 address, and ensure that any user‑initiated connections to the domain are blocked at the network perimeter. Ongoing threat‑intel feeds should be consulted for potential re‑appearance, and any related indicators of compromise should be shared with relevant information‑sharing groups.