The online drug trade behind QR code stickers plastered on streets across UK

Steve first spotted the eye-catching stickers while walking to the shops in Burton upon Trent.

Plastered on bins and lamp posts, they featured a shiny, green cannabis leaf with a QR code and the words "get your delivery". The former prison officer, who is in his 50s, wanted to try the Class B drug as an alternative to prescribed opiates to ease his pain after breaking his back in three places.

He had only recently moved to the Staffordshire market town and was reluctant to buy off the street. "I didn't want to just tap up some roadman," he says.

Using his smartphone camera, he was taken to a slick, colourful site on the open web offering a wide range of cannabis products - from vapes and tinctures to pre-rolled joints, buds and gummies. Just like legitimate online shops, it promised free delivery to arrive the next day and had glowing reviews on Google and Trustpilot.

Steve (not his real name) went on to order products including vapes and herbal cannabis. "The first time I was shaking… when the postman came down the path - the package absolutely stank," he says.

"It's letterbox shaped so you don't get a knock. The postman shoves it through your door and that's it - job done." Similar stickers have been reported across the UK, from cities such as Birmingham, Glasgow and London, to smaller towns including Shrewsbury, in Shropshire, and Droitwich, in Worcestershire.

There have also been sightings in South Wales. Some have appeared near schools, universities and police stations.

Hidden gang network A Sky News investigation has identified three different sticker designs, each of which directs users to separate, but linked, websites (which we are not naming), with their own branding. Hidden in their source code is a long list of bank accounts and business names which are randomly selected when users make a purchase.

Using publicly available tools, we were able to build a network map of the businesses involved, the people behind them and how they are linked. All are Lithuanian nationals, mostly registered to addresses in a small area of east London, one of which is linked to an alleged gangster found guilty of kidnap and torture in Lithuania.

Royal Mail tracking details also suggest the operation is based in this area as the packages passed through Romford’s mail centre. An analysis of Bitcoin wallets - carried out by TRM Labs - shows one of the sites had received around $109,000 (£82,000) by mid-March, although the true income is likely to be far higher as more buyers use regular bank transfers than cryptocurrency.

When we visited a woman who owns two of the houses associated with the bank accounts, she said she had never heard of the website and had no idea a criminal enterprise may be being run from her properties. She also said three Lithuanian nationals we identified as being connected with the site had left the UK.

Former head of drugs threat and intelligence for the National Crime Agency (NCA), Tony Saggers, says the scale of the operation suggests those behind it have access to wholesale quantities of cannabis, which has probably been grown in the UK. It also demonstrates the "evolution of online drug markets" from the dark web to open websites, "making them more accessible to the wider population.