Phishing Campaign Uses Fake 'Suspended' Pages to Evade Bank Site Takedowns
Threat intelligence firm Kela has identified a large-scale phishing campaign, dubbed the 'Suspended' infrastructure, that has been active since May 2026 and uses over 300 fake domains, including 248 impersonating 189 US financial institutions. The kit fingerprints visitor IP addresses to serve a convincing bank login page on first visit, then displays a fake 'This account has been suspended' notice on subsequent visits — specifically targeting security teams, scanners, and takedown providers who typically re-check a reported site before confirming it is down. As of October 25, 183 targeted organizations still had live look-alike sites, with 49 new domains appearing in the prior week alone, about half using help-desk, live-chat, and treasury-portal naming templates impersonating banks like JPMorgan, Citi, BMO, and Santander. The campaign primarily targets business banking and treasury logins rather than personal accounts, and has expanded to victims in the UK, Australia, and New Zealand.
Detalhes técnicos
First-time visitors see a branded phishing page requesting user ID and password, sometimes with a reCAPTCHA, and a tab title reading 'Attention required' mimicking Cloudflare's challenge page; a script also blocks browser developer tools. Domain names follow a formula combining a keyword (e.g., 'secure', 'disable', 'protect', 'cancel', 'authorize', 'terminate', 'credentials', 'commercial') with the targeted bank's name, hyphenated. The sites sit behind Cloudflare to obscure hosting, though some briefly resolved to their real servers, allowing Kela to trace actual hosting infrastructure shared across domains. Some phishing pages instead redirect to Google or show alternate fake notices, further complicating detection by public scanning services.
Remediação
Kela notes that detecting live phishing content behind the fake suspension pages requires checking from a fresh IP address for every verification attempt, since repeat checks from the same IP will be shown the fake 'suspended' page regardless of the site's actual live status.
Linha do tempo
-
Phishing Campaign Uses Fake 'Suspended' Pages to Evade Bank Site Takedowns
ler a análise desta fonte ocultar
Threat intelligence firm Kela has identified a large-scale phishing campaign, dubbed the 'Suspended' infrastructure, that has been active since May 2026 and uses over 300 fake domains, including 248 impersonating 189 US financial institutions. The kit fingerprints visitor IP addresses to serve a convincing bank login page on first visit, then displays a fake 'This account has been suspended' notice on subsequent visits — specifically targeting security teams, scanners, and takedown providers who typically re-check a reported site before confirming it is down. As of October 25, 183 targeted organizations still had live look-alike sites, with 49 new domains appearing in the prior week alone, about half using help-desk, live-chat, and treasury-portal naming templates impersonating banks like JPMorgan, Citi, BMO, and Santander. The campaign primarily targets business banking and treasury logins rather than personal accounts, and has expanded to victims in the UK, Australia, and New Zealand.
Technical Details
First-time visitors see a branded phishing page requesting user ID and password, sometimes with a reCAPTCHA, and a tab title reading 'Attention required' mimicking Cloudflare's challenge page; a script also blocks browser developer tools. Domain names follow a formula combining a keyword (e.g., 'secure', 'disable', 'protect', 'cancel', 'authorize', 'terminate', 'credentials', 'commercial') with the targeted bank's name, hyphenated. The sites sit behind Cloudflare to obscure hosting, though some briefly resolved to their real servers, allowing Kela to trace actual hosting infrastructure shared across domains. Some phishing pages instead redirect to Google or show alternate fake notices, further complicating detection by public scanning services.
Remediation
Kela notes that detecting live phishing content behind the fake suspension pages requires checking from a fresh IP address for every verification attempt, since repeat checks from the same IP will be shown the fake 'suspended' page regardless of the site's actual live status.