🌐 Dark Web Watch — New Wave of UK Brand Phishing Domains

03 August 2026

Our DarkWatch dark web monitoring pipeline has detected a new wave of high-severity phishing threats targeting UK families and businesses — 548 new items in the last 24 hours, all flagged with direct UK relevance.

These are live findings, not historical examples — the same kind of lookalike domains that end up in your texts and inbox as fake bank alerts.

What DarkWatch detected

| Brand | Activity | | Bt | 75 lookalike domain(s) detected in this wave | | Sky | 65 lookalike domain(s) detected in this wave | | Barclays | 60 lookalike domain(s) detected in this wave | | Nationwide | 55 lookalike domain(s) detected in this wave | | Amazon | 48 lookalike domain(s) detected in this wave | | Lloyds | 46 lookalike domain(s) detected in this wave | | Paypal | 43 lookalike domain(s) detected in this wave | | Hsbc | 38 lookalike domain(s) detected in this wave |

Example lookalike domains detected: www.royalmailhotel.co.nz, mta-sts.nhs2go.net, www.barclays-corp.info, www.barclays-website.ph, barclayscourierja.com, swww.hsbchwww.mhgfihgbadevportalrnr-dedicated-bn1-05040552.portal-ed.accounts.smo.lt

⚠️ The pattern: the domains contain the brand name but are not the brand's real website. Criminals register these lookalikes daily and use them in texts, emails, and adverts.

What the criminals do with them

  1. Register a lookalike domain — containing the brand name so it passes a quick glance
  2. Build a convincing fake page — cloned login screens, delivery-tracking pages, billing alerts
  3. Send the bait — a text ("your parcel is held", "unusual activity on your account") or email with a link
  4. Harvest your details — card numbers, passwords, one-time codes
  5. Drain accounts fast — often within minutes

How to protect yourself

  • ❌ Never click links in unexpected texts or emails — go to the brand's official app or website directly
  • ❌ Never enter card or login details on a page you reached via a message
  • ✅ Check the domain — hover over links and check the real address
  • ✅ Use the official app for banking and deliveries
  • ✅ Forward suspicious texts to 7726 — free, blocks the sender network-wide
  • ✅ Report phishing emails to [email protected]
  • ✅ Never share one-time codes — with anyone, for any reason

If you've already clicked

  1. Call your bank's fraud line immediately — cancel the card
  2. Report to Action Fraud — 0300 123 2040 or actionfraud.police.uk
  3. Get a crime reference number — see our guide
  4. If money was taken, act fast — see how to get your money back after a scam

About this watch

This brief comes from DarkWatch — our live dark web monitoring pipeline. See the live threat board at cyberawareuk.co.uk/darkwatch.

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.