uk[.]paying-gc[.]vip

The domain uk.paying-gc.vip was registered on December 16, 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and is served from the Fastly content‑delivery network (AS54113) at IP address 151.101.64.144, which geolocates to the United States. Authoritative nameservers dns29.hichina.com and dns30.hichina.com resolve the domain, and no SSL certificate is present, indicating that the site was reachable only over plain HTTP. The page title returned by the host is "Welcome to GOV.UK", suggesting an attempt to impersonate the United Kingdom government portal. Security telemetry shows that 14 of 95 VirusTotal‑listed security vendors flagged the domain, and it appears on a single external blocklist.

PhishDestroy has also listed the domain as blocked, and the current operational status is recorded as taken offline. The Gridinsoft trust score for the domain is 0 out of 100, reinforcing the malicious assessment. While the available data confirms the domain’s association with a generic phishing campaign targeting users of the UK government service, the specific phishing kit, payload, or victim interaction details remain unknown because no further content analysis was provided.

Defenders should continue to block the domain at perimeter filters, update intrusion‑prevention signatures with the observed IP and nameserver information, and monitor for any re‑registration attempts. Additional investigation of HTTP traffic logs for requests to 151.101.64.144 may reveal attempted credential harvesting sessions. Continuous observation of reputation feeds is advised to capture any resurgence of the domain or related infrastructure.