KELA exposes 'Suspended' phishing network: 248 fake bank domains use fake takedown pages to evade detection
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 06/11/2026 12:09; os links antigos trazem para cá.
Fontes: securityweek.com ↗ zdnet.com ↗
Threat intelligence firm KELA has uncovered a large phishing and scam operation dubbed the 'Suspended' infrastructure. It has been active since May 2026 and has used more than 300 domains (zdnet.com, securityweek.com). As of October 25, 2026, 248 live domains impersonated 189 US banks and financial institutions, and 183 targeted organizations still had live look-alike sites (securityweek.com). 49 new domains appeared in the prior week alone, and about half used help-desk, live-chat and treasury-portal naming templates imitating brands such as JPMorgan, Citi, BMO and Santander (securityweek.com). The campaign mainly targets business banking and treasury logins rather than personal accounts, and has expanded to victims in the UK, Australia and New Zealand (securityweek.com). It remains active, with new domains appearing daily (zdnet.com). One unverified lead points to a UK home broadband connection used to remotely access the infrastructure (zdnet.com).
Detalhes técnicos
- Self-suspension trick: the kit logs each visitor's IP address. First-time visitors see a cloned bank login page asking for user ID and password, sometimes with a reCAPTCHA. On later visits from the same IP, the kit shows a fake 'This account has been suspended' notice (zdnet.com, securityweek.com). This misleads security teams, scanners and takedown providers that re-check a reported site, making them believe it is already down (securityweek.com).
- Cloudflare imitation: the pages mimic Cloudflare challenge pages, including a tab title reading 'Attention required' (zdnet.com, securityweek.com).
- Other decoys: 'Sorry, you've been blocked' messages, blank pages, redirects to Google, and a script that blocks browser developer tools (zdnet.com, securityweek.com).
- Domain naming: a hyphenated [keyword]-[bank].com pattern. Keywords include 'secure', 'disable', 'protect', 'cancel', 'authorize', 'terminate', 'credentials' and 'commercial' (zdnet.com, securityweek.com).
- Hosting: the sites sit behind Cloudflare to hide their hosting. Some briefly resolved to their real servers, which let KELA trace hosting infrastructure shared across domains (securityweek.com).
Remediação
- To detect live phishing content behind the fake suspension pages, check from a fresh IP address for every verification attempt. Repeat checks from the same IP are shown the 'suspended' page regardless of the site's real status (securityweek.com).
- KELA released a free Bank Phishing Check tool so organizations can compare their official domains against the uncovered infrastructure (zdnet.com).
- User guidance from KELA: verify URLs with phishing link checkers; treat unsolicited bank communications with suspicion; watch for unusual sender addresses, poor formatting, emotionally manipulative content and suspicious links or attachments; and call the bank directly, not via numbers given in the suspicious message (zdnet.com).
Linha do tempo
-
Phishing Campaign Uses Fake 'Suspended' Pages to Evade Bank Site Takedowns
ler a análise desta fonte ocultar
Threat intelligence firm Kela has identified a large-scale phishing campaign, dubbed the 'Suspended' infrastructure, that has been active since May 2026 and uses over 300 fake domains, including 248 impersonating 189 US financial institutions. The kit fingerprints visitor IP addresses to serve a convincing bank login page on first visit, then displays a fake 'This account has been suspended' notice on subsequent visits — specifically targeting security teams, scanners, and takedown providers who typically re-check a reported site before confirming it is down. As of October 25, 183 targeted organizations still had live look-alike sites, with 49 new domains appearing in the prior week alone, about half using help-desk, live-chat, and treasury-portal naming templates impersonating banks like JPMorgan, Citi, BMO, and Santander. The campaign primarily targets business banking and treasury logins rather than personal accounts, and has expanded to victims in the UK, Australia, and New Zealand.
Technical Details
First-time visitors see a branded phishing page requesting user ID and password, sometimes with a reCAPTCHA, and a tab title reading 'Attention required' mimicking Cloudflare's challenge page; a script also blocks browser developer tools. Domain names follow a formula combining a keyword (e.g., 'secure', 'disable', 'protect', 'cancel', 'authorize', 'terminate', 'credentials', 'commercial') with the targeted bank's name, hyphenated. The sites sit behind Cloudflare to obscure hosting, though some briefly resolved to their real servers, allowing Kela to trace actual hosting infrastructure shared across domains. Some phishing pages instead redirect to Google or show alternate fake notices, further complicating detection by public scanning services.
Remediation
Kela notes that detecting live phishing content behind the fake suspension pages requires checking from a fresh IP address for every verification attempt, since repeat checks from the same IP will be shown the fake 'suspended' page regardless of the site's actual live status.
-
Fake Bank Phishing Network Uses Self-Suspension Trick to Evade Takedowns, 248 Domains Live
ler a análise desta fonte ocultar
KELA researchers uncovered an active financial-scam infrastructure, dubbed the "Suspended" infrastructure operation, running hundreds of cloned banking websites that fake their own suspension to evade detection and takedown. As of October 25, 2026, 248 live phishing/scam domains tied to 189 major US banks and financial services firms have been linked to the campaign, with over 300 domains hosted on the same infrastructure since May 2026. The scheme targets business banking customers using a [keyword]-[bank].com naming pattern with words like "secure," "disable," "protect," and "cancel." The campaign remains active, with new domains appearing daily, and one unverified lead points to a UK home broadband connection used to remotely access the infrastructure.
Technical Details
The phishing kit logs the IP address of each visitor and, on a victim's second visit, displays a fake "account suspended" page styled to resemble legitimate Cloudflare challenge pages, tricking scanners and security teams into believing the site was already taken down while real victims (on their first visit) still see the cloned banking site and are lured into entering credentials. Other decoys observed include "Sorry, you've been blocked" messages, blank pages, redirects to Google, reCAPTCHAs, and anti-analysis scripts that block browser developer tools.
Remediation
KELA recommends using phishing link checkers to verify URLs, treating unsolicited bank communications with suspicion, watching for unusual sender addresses, poor formatting, emotionally manipulative content, and suspicious links/attachments, and calling the bank directly (not via numbers in the suspicious message) to verify legitimacy. KELA has released a free Bank Phishing Check tool allowing organizations to compare their official domains against the uncovered scam infrastructure.