Real or fake: check the address, not the message
Scam texts copy the look of real notices: an unpaid toll, a package that could not be delivered, a tax refund. The fastest check is the domain in the link. Official sites look like this:
| Service | Official address |
|---|---|
| IRS | irs.gov |
| USPS | usps.com |
| E-ZPass (New York) | e-zpassny.com |
| Medicare | medicare.gov |
| Royal Mail | royalmail.com |
| GOV.UK, DVLA, HMRC | gov.uk |
US government sites end in .gov, UK government sites in .gov.uk. A link ending in .shop, .help, .top, .cc or .pages.dev is not the IRS, USPS or your toll agency.
The fake sites we blocked
Every domain below is blocked today (23 October 2026) in EZOBLOCKER's Security category. Dots are written as [.] so the addresses cannot be clicked. "First seen" is the day the domain first appeared.
Toll and E-ZPass scam sites
| Domain | Pretends to be | First seen |
|---|---|---|
toll-linkt-services[.]shop | unpaid toll payment | 14 Sep 2026 |
toll-unpaid-support[.]help | unpaid toll support | 28 Sep 2026 |
ezpassmaineturnpike[.]info | E-ZPass, Maine Turnpike | 6 Oct 2026 |
itoll-due[.]help | toll due notice | 7 Oct 2026 |
e-zpassnyet[.]cc, e-zpassnyre[.]top | E-ZPass New York | 8-9 Oct 2026 |
ezpass-nh[.]com | "NH E-ZPass Login" page with a password field | 20 Oct 2026 |
e-zpassct[.]com | "EZ Pass CT Login" page with a password field | 20 Oct 2026 |
USPS, IRS and Medicare scam sites
| Domain | Pretends to be | First seen |
|---|---|---|
irs-support-team[.]pages[.]dev | IRS support | 9 Sep 2026 |
secureportal-irs-support[.]pages[.]dev | IRS secure portal | 15 Sep 2026 |
medicarewallet[.]net | Medicare "grocery allowance" | 9 Sep 2026 |
medicare-online[.]cc | Medicare sign-in page | 28 Sep 2026 |
lus-usps[.]shop | USPS | 6 Oct 2026 |
us-usps-gj[.]xyz | USPS | 7 Oct 2026 |
usps-com[.]cfd | USPS | 11 Oct 2026 |
uspsdelivery[.]net | USPS delivery | 20 Oct 2026 |
energy-rebate-gov[.]com | government energy rebate | 21 Oct 2026 |
We also block fedex-tracking[.]pages[.]dev and ups-tariff-refund[.]com, a page dressed up as a UPS tariff refund request.
UK: Royal Mail, GOV.UK and HMRC scam sites
| Domain | Pretends to be | First seen |
|---|---|---|
royalmail-redelivery[.]icu | Royal Mail redelivery | 19 Sep 2026 |
royalmail-redelivery[.]com | Royal Mail redelivery | 2 Oct 2026 |
hmrc-support[.]work | HMRC | 6 Oct 2026 |
vehicle-tax-govuk[.]online | GOV.UK "Tax your vehicle" page | 15 Oct 2026 |
None of these brands or agencies is connected to EZOBLOCKER; their names appear only to show what the fake sites copy.
Got one of these texts? What to do
- Do not tap the link. Read the domain: if it is not the official address above, it is fake.
- Open the official app or type the address yourself to check a toll balance, a package or a tax notice.
- If you entered card details, call your bank using the number on the back of the card. If you entered a password, change it on the real site.
- Forward the text to 7726 (US and UK). In the US, also report it at ReportFraud.ftc.gov.
What EZOBLOCKER does with these sites
When an app or the browser on your phone tries to reach a domain on our lists, the DNS request goes encrypted to our servers and they do not return a usable answer. The page does not load and the scam form does not appear. The Security category is on by default, so there is nothing to set up. If a parent or a child uses the phone, Family lock asks for a PIN before anyone can change the categories.
We catch new fake sites every day and add them to our lists. A brand-new domain that is not on our lists yet still opens normally. What DNS cannot block explains the limits, and the protection check shows whether the Security category works on your phone. All phishing sites we caught in the same period are in the phishing report.