Peacemaker Threat Landscape Q3 2026: United Kingdom

758,715,537 threats blocked in Q3 2026

That is about 8.4 million blocked requests on British ISP networks every day, and 25% of the 3.1 billion threats Whalebone stopped across six European markets in the quarter. Every one of them was a device inside an ISP's network reaching for a malicious domain.

What you will find in the report:

What British networks blocked: malware 79%, blacklist 12%, phishing 7%, and other 2%
Three global threat domains Whalebone blocked in every market it monitors
Local threat of the quarter: a fake Lloyds Bank login page built to trap British customers

Why it matters for ISPs

Malware works in the background: infected devices contact their servers automatically and repeatedly.
Every one of those contacts is a DNS request, which is why malware outnumbers the phishing people actually notice.
Whalebone Peacemaker blocks the DNS request before the page loads, so the customer never reaches the site.

Local threat of the quarter

A fake Lloyds Bank login page targeting British customers. The phishing site closely replicates the Lloyds Bank Internet Banking login page to persuade victims to enter their User ID and password.

Domain, defanged for safety: benetekcorp[.]com

About the report

Where does the data come from?

Whalebone threat intelligence: DNS requests blocked on customer networks in the United Kingdom in Q3 2026 (UTC). Shares are of all blocked threats in the market and are rounded to whole percent.

Do I need to fill in a form?

No. The report is free to download, no registration needed.

How can my ISP get the same protection?

Start a free 30-day trial of Whalebone Peacemaker at whalebone.io/peacemaker-trial.