🌐 Dark Web Watch — New Wave of UK Brand Phishing Domains
17 September 2026
Our DarkWatch monitoring feed draws on live phishing-domain and dark web sources; in the last 24 hours it flagged 449 high-severity lookalike domains imitating UK brands, each checked for direct UK relevance.
These are live findings, not historical examples: the same lookalike domains that arrive in your texts and inbox as fake bank, parcel and billing alerts.
The 30-second version
- Treat any unexpected text or email link as suspect — open the brand's own app or type the address yourself.
- Never enter card or login details on a page you reached from a message.
- Forward suspicious texts to 7726 and phishing emails to [email protected].
What DarkWatch detected
| Brand | Activity |
|---|---|
| BT | 88 lookalike domain(s) detected in this wave |
| Sky | 72 lookalike domain(s) detected in this wave |
| Amazon | 63 lookalike domain(s) detected in this wave |
| Barclays | 53 lookalike domain(s) detected in this wave |
| PayPal | 48 lookalike domain(s) detected in this wave |
| Lloyds | 31 lookalike domain(s) detected in this wave |
| Nationwide | 19 lookalike domain(s) detected in this wave |
| Vodafone | 18 lookalike domain(s) detected in this wave |
Example lookalike domains detected: www.upstreamonline.com, www.whitbyhealthpartnershipellesmereport.nhs.uk, barclaysnmwaleswelfareclub.ph, barclaysfrozenpreview.ph, barclays.one, hsbc-fedexsubdelive.ph
⚠️ The pattern: the domains contain the brand name but are not the brand's real website. Criminals register these lookalikes daily and use them in texts, emails, and adverts.
What the criminals do with them
- Register a lookalike domain — containing the brand name so it passes a quick glance
- Build a convincing fake page — cloned login screens, delivery-tracking pages, billing alerts
- Send the bait — a text ("your parcel is held", "unusual activity on your account") or email with a link
- Harvest your details — card numbers, passwords, one-time codes
- Drain accounts fast — often within minutes
How to protect yourself
- ❌ Never click links in unexpected texts or emails — go to the brand's official app or website directly
- ❌ Never enter card or login details on a page you reached via a message
- ✅ Check the domain — hover over links and check the real address
- ✅ Use the official app for banking and deliveries
- ✅ Forward suspicious texts to 7726 — free, blocks the sender network-wide
- ✅ Report phishing emails to [email protected]
- ✅ Never share one-time codes — with anyone, for any reason
If you've already clicked
- Call your bank's fraud line immediately — cancel the card
- Report to Action Fraud — 0300 123 2040 or actionfraud.police.uk
- Get a crime reference number — see our guide
- If money was taken, act fast — see how to get your money back after a scam
About this watch
This brief comes from DarkWatch — our live dark web monitoring pipeline. See the live threat board at cyberawareuk.co.uk/darkwatch.
Related guides
- Smishing scams UK — fake texts explained
- Parcel delivery scam texts UK
- What is phishing and how to spot it
- The dark web explained in plain English
CyberAware UK — helping families report crime, recover from scams, and stay safe online.