uk[.]paying-jt[.]vip

Analysis of the domain uk.paying-jt.vip indicates it was a short-lived phishing site impersonating the UK Government's official portal. The domain, registered on December 16, 2025, through Alibaba Cloud Computing Ltd. (HiChina), was taken offline by July 24, 2026. Its page title, 'Welcome to GOV.UK,' directly matches the legitimate government site, suggesting an intent to deceive users seeking official services. Infrastructure analysis reveals the domain resolved to 151.101.128.144, an IP address associated with AS54113 (Fastly, Inc.) in the United States, a hosting provider not typically linked to UK government services. No SSL certificate was present, a red flag for any site handling sensitive data.

Detection data from July 2026 shows 13 of 95 security vendors flagged uk.paying-jt.vip as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appeared on one security blocklist, specifically PhishDestroy. Nameservers were hosted under dns9.hichina.com and dns10.hichina.com, consistent with the registrar's infrastructure. No evidence links this domain to a known phishing kit or campaign, and the exact content beyond the page title remains unanalyzed.

Defenders should treat this domain as confirmed malicious based on its page title, detection history, and infrastructure anomalies. Blocking the domain and its resolved IP at perimeter security controls is recommended. Organizations should also monitor for any residual DNS queries or attempts to re-register the domain under a different TLD or registrar. Given the use of a major CDN provider, network logs should be reviewed for connections to 151.101.128.144 during the domain's active period.