Science & Tech · Cybersecurity · 2 hrs ago
Fake bank sites show false suspension notices to evade detection
A phishing campaign has used more than 300 fake domains since May to target banks and financial institutions.
The domains include 248 impersonating 189 US financial organizations, with many targeting business banking and treasury logins.
New visitors see cloned bank login pages, while the sites record their IP addresses.
On a return visit, the same site shows a fake suspension notice, making it look as if the domain has already been shut down.
That can mislead security teams and takedown providers who check a reported site more than once, while new visitors may still be exposed to the phishing page.
The campaign also targets people in the UK, Australia and New Zealand, and 183 targeted organizations still had live look-alike sites as of October 25.
The operation remains active, with new domains appearing, though the sources do not say what action will follow.
A phishing campaign uses fake suspension notices to hide cloned bank websites from repeat visitors and security checks.
Kela says the infrastructure has hosted more than 300 fake domains since May, including 248 impersonating 189 US financial institutions.
On a first visit, the sites show bank-branded login pages; on a return visit, they may show a fake account-suspension notice.
The campaign mainly targets business banking and treasury logins, and researchers traced targets in the UK, Australia and New Zealand as well as the US.
- Who
- A threat actor operating the phishing infrastructure; Kela researchers reported on it.
- What
- Fake bank websites show login pages to first-time visitors and may show fake suspension notices to returning visitors.
- When
- The campaign has been active since May; figures cited by the sources are as of October 25, 2026.
- Where
- The sites impersonate US financial institutions and also target victims in the UK, Australia and New Zealand.
- Why
- To make scanners and security teams think a site has been taken down, helping the phishing sites evade detection and takedown.
This story does not have two clearly opposing sides.
The first domains in the infrastructure were registered.
The campaign was active by this month, according to SecurityWeek.
Most of the fake domains appeared during this period.
248 domains impersonating 189 US financial institutions were linked to the infrastructure; 183 targeted organizations still had live look-alikes.
49 new domains appeared.
- Fake domains
- More than 300 hosted on the infrastructure since May
- US targets
- 248 domains impersonated 189 US financial institutions
- Live look-alikes
- 183 targeted organizations as of October 25, 2026
- Other countries
- UK, Australia and New Zealand
- Main targets
- Business banking and treasury logins
2 sources
What people are saying
What ties them together is one mechanism: the kit remembers every visitor’s IP address, so the first visit gets a bank login page, and any return visit gets what looks like a closed hosting account. We call this cluster the ‘Suspended’ infrastructure
That design targets exactly the people who could shut a site down. A victim typically follows a link once. A scanner, a security team, or a takedown provider checks a reported site, then checks it again to confirm, and the second check shows what looks like a completed takedown.
A scanner, a security team or a takedown provider checks a reported site and then checks it again to confirm, and the second check shows what looks like a completed takedown.