uk[.]paying-le[.]vip

The domain uk.paying-le.vip was registered on December 17, 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and is currently taken offline. DNS resolution points to the IP address 151.101.0.144, which belongs to AS54113 Fastly, Inc. in the United States. No SSL certificate is presented for the host, and the authoritative nameservers are dns13.hichina.com and dns14.hichina.com. The page title observed during active probing was "Welcome to GOV.UK", indicating an attempt to impersonate a UK government portal.

Threat intelligence records classify the site as generic phishing with an elevated risk rating. Fifteen of ninety‑five security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist, specifically PhishDestroy. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100.

While the site is no longer serving content, the infrastructure details—including the Fastly edge IP and Chinese registrar—suggest a short‑lived phishing campaign that leveraged a reputable CDN to hide origin. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor for any resurgence of the same IP or nameserver pair, and add the domain to internal threat feeds. Given the lack of SSL and the low trust score, any inbound traffic to this host should be treated as malicious, and endpoint security solutions should be configured to quarantine associated artifacts.