Guardians of .UK increase focus on tackling abuse and improving domain health
Oxford, UK – May 12, 2025 – Nominet, guardians of the .UK domain has today released its annual update on .UK domains suspended for criminal activity for the 12 months to 31st October 2024.
During this year, Nominet’s proactive detection and analysis of domain abuse increased significantly from 2,230 sites suspended in 2023, to 6,315 in 2024. A higher number of detections from threat feeds and coordinated and targeted investigations led to a greater number of mass suspensions – developing increased confidence in identifying and acting on abuse.
The key abuse trends spotted on .UK in the year included:
Mobile providers
In 2024, scam calls pretending to be from UK mobile providers affected a growing number of individuals, with fraudsters registering domains ending in .UK to appear legitimate. We suspended 176 domains with ‘Three’ in the name – including threeonlinepromotions[.]co[.]uk, and threesupport[.]co[.]uk. Similar patterns were spotted for all other major UK networks.
Fake education registrations
We identified patterns of domain registrations impersonating genuine UK educational establishments, which were suspended. These were attempts to lure visitors into providing details to a site like looks identical to that of the school itself. We suspended 207 .UK domains pretending to be colleges, 80 universities, and six schools.
Fake Retailers
With improved detection of fake fashion brand websites – we’ve been focusing on those that falsely claim to sell clothing ‘drops’ that are made in limited numbers. We suspended 29 registrations for Essentials, 12 for Corteiz and 11 for Trapstar. We are unable to stop scammers entirely – but we can stop them using .UK domains to target consumers.
Law enforcement takedowns
We also continue to work closely with law enforcement to help protect internet users from criminality online. When alerted by these agencies, we work quickly with our registrars to suspend domains in accordance with our Criminal Practices Policy.
Domains suspended for criminal activity under this policy are at the lowest since we started tracking in 2013. This year we suspended 913 domains, down from 1,193 in 2023.
We’ve collaborated with law enforcement to target illegal streaming sites. This high-profile effort, involving both the police and other organisations, has led to the shutdown and prosecution of illegal streaming service providers.
We are actively identifying and monitoring continued registration patterns and are suspending these domains.
Looking Ahead – a new Domain Health Initiative
In the second half of 2025, Nominet will begin rolling out a new Domain Health Initiative, which has an ambitious aim:
To make .UK the most trusted namespace through proactive, proportionate, and collaborative measures. We seek to achieve systemic deterrence against abuse, while preserving the openness and accessibility of the domain space.
We strongly believe a healthy domain is a win for registrars and internet users too. We believe this initiative will also help to improve and sustain our registrar’s businesses by reducing fraud, minimising online harms and improving renewal rates.
You can find out more about the Domain Health Initiative here
Paul Fletcher, Nominet’s CEO, said:
“Our latest report reveals a significant step forward in our ongoing efforts to create a safer digital world. By leveraging advanced threat detection tools and working closely with law enforcement, we’ve not only increased our ability to identify and suspend criminal domains, but we’re also disrupting sophisticated online criminal networks targeting vulnerable people.”
“We’ve seen a marked increase in proactive abuse detection, demonstrating our commitment to protecting internet users from emerging online threats. And we’re going one step further in 2025 and beyond, with a new Domain Health Initiative – which looks to keep .UK’s openness and accessibility – but achieve systemic deterrence against abuse.”
ENDS
Note to editors:
In previous editions of Nominet’s criminality report, ‘domain abuse activity reporting’ was named ‘threat feeds’ The methodology for reporting on this has remained the same, but we have renamed this section to better reflect the sources of this data, and mirror common industry terms.
About Nominet
Nominet is the guardian of the UK’s national domain name registry, driven by a commitment to be a force for good in the nation’s digital economy and the global internet community. Since 1996, Nominet has operated at the heart of the internet, protecting and connecting over 10 million domains within the .UK namespace, and underpinning critical internet infrastructure that government services rely on. Through our work and the projects we fund, we aim to create positive societal impact; transforming lives by shaping a safer, more interconnected and inclusive world.
Find out more at nominet.uk