UK mobile "account recovery" kit: carrier and bank look-alikes that show the lure only to UK phones

One phishing kit used by several operators against customers of UK mobile carriers, banks and other services (EE, O2, Lloyds, Santander, Student Finance England and Evri have been seen). Each copy is a single-page app on free hosting with an "account recovery", "pending payment" or "billing" name, such as ee-recover-account[.]web.app. A config file decides who sees the lure: computers and crawlers are sent to the brand's real website, and an IP check sends visitors outside the UK there too, so only a UK phone gets the fake pages. Those ask for the account login, personal details, the card number with its expiry and security code, bank account details, one-time codes and the number-porting (PAC) code, which lets the operator move the victim's phone number to a SIM they control. Each step goes to the operator's backend. A match means a page carrying the kit's code, or a scan that contacted one of its known backends.