● Covered by 2 sources · 2 reportsMedium impact2 neutral
Banking Scam Infrastructure Fakes Domain Suspensions to Evade Detection
Key points
- Scam infrastructure hosts hundreds of fake banking websites.
- Websites display fake suspension notices to security scanners.
- Victims see the phishing site, scanners see a takedown notice.
- 248 domains linked to 189 US banks were identified.
- Campaign active since May.
- Over 300 fake domains impersonate 189 US financial institutions.
- First domains registered late 2025, most between July and September 2026.
- As of October 25, 183 targeted organizations still had live look-alikes.
- Last week, 49 new domains appeared.
- Phishing sites primarily target business banking and treasury logins.
- Domains use keywords like 'secure', 'disable', 'protect', 'cancel', 'authorize', 'terminate', 'credentials', 'commercial'.
- Smaller group uses 'help-desk', 'live-support', 'treasury-portal', 'primary device' names.
Deceptive Suspension Tactic Uncovered
Cybersecurity firm KELA has revealed an active financial scam operation utilizing hundreds of fraudulent websites. These sites are designed to appear suspended to security scanners and researchers, while remaining fully operational for potential victims. This tactic allows the phishing infrastructure to persist online longer by avoiding legitimate takedowns.
Scope of the Operation
As of October 25, 2026, KELA identified 248 financial scam and phishing domains linked to this infrastructure. These domains impersonate 189 major US banks and financial services, with a particular focus on business banking. Many fraudulent URLs use formats like '[keyword]-[bank].com', incorporating terms such as 'secure', 'disable', 'protect', and 'cancel'.
How the Fake Takedown Works
The phishing campaign employs a unique method to protect its sites. When a visitor accesses one of these fraudulent domains, a phishing kit registers their IP address. On a subsequent visit from the same IP, the visitor is shown a fake 'account suspended' page, designed to mimic legitimate suspension notices or challenge pages from services like Cloudflare. This deceptive display is primarily intended for security scanners and teams, making the site appear inactive or taken down, while actual victims continue to see the phishing content.
Additional Evasion Techniques
Beyond fake suspension notices, the scam infrastructure uses other decoys, including 'Sorry, you’ve been blocked' messages, blank pages, and redirects to Google. Some pages also incorporate reCAPTCHAs, and researchers found scripts designed to block browser developer tools, likely to hinder analysis and investigation efforts.
Updates
- Campaign active since May.
- Over 300 fake domains impersonate 189 US financial institutions.
- First domains registered late 2025, most between July and September 2026.
- As of October 25, 183 targeted organizations still had live look-alikes.
- Last week, 49 new domains appeared.
- Phishing sites primarily target business banking and treasury logins.
- Domains use keywords like 'secure', 'disable', 'protect', 'cancel', 'authorize', 'terminate', 'credentials', 'commercial'.
- Smaller group uses 'help-desk', 'live-support', 'treasury-portal', 'primary device' names.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A phishing campaign, active since May, uses over 300 fake domains impersonating 189 US financial institutions. The campaign serves a bank login page to first-time visitors and a fake 'account suspended' notice to repeat visitors, including security researchers, to evade takedowns. This tactic allows the phishing sites to remain active longer, primarily targeting business banking and treasury logins.
KELA researchers uncovered a financial scam operation using hundreds of fraudulent websites that display fake suspension notices to evade detection by security scanners. These sites clone legitimate banking domains and target business banking customers, showing a false takedown page on a visitor's second visit while remaining active for victims.