Suspended Bank Phishing Infrastructure: Look-Alike Sites That Fake Their Own Takedown
KELA's Suspended bank phishing infrastructure: 300+ look-alike domains show a login page once per visitor IP, then a fake hosting suspension notice.
AegisAI Threat IntelligenceAegisAI Threat Watch · Phishing takedown evasion
Suspended Bank Phishing Infrastructure: Look-Alike Sites That Fake Their Own Takedown
Bank look-alike sites remember each visitor's IP address and show a fake hosting suspension notice to anyone who checks twice.
- What
- More than 300 bank look-alike domains since May 2026 show a login page once per visitor IP, then a fake suspension notice.
- Who it hits
- Customers of 189 US financial institutions, mostly mid-sized regional banks, with many pages built for business banking and treasury logins.
- Why checks miss it
- A repeat visit from the same address sees a closed hosting account, so a live phishing site can be marked as taken down.
- Do today
- Re-check reported look-alikes from a new IP address over several days, and monitor keyword-plus-bank-name domains.
The Suspended phishing infrastructure is a network of more than 300 bank look-alike domains that shows a login page once per visitor IP address, then a fake takedown notice to anyone who checks again.
Threat Watch has covered scanner cloaking before, in the Athena StealthRoute and YAM Store kits, and the AegisAI blog explains why CAPTCHA detection fails against cloaked pages. Those kits hide a lure from the first scan. This cluster fakes the result of the second one: the check that confirms a takedown worked. Analysis based on KELA research, updated 3 November 2026.
The numbers describe the operator's infrastructure, not victims. KELA reports no count of victims or stolen credentials.
Key judgments
- The takedown check is the target. KELA reports that the kit records each visitor's IP address, serves the login form to a first visit and a "This account has been suspended" page to any later visit from that address.
- One recheck proves nothing. KELA says seeing the live content requires a new IP address for every check, so a provider can mark a domain as down while it still serves new visitors.
- The scale sits in mid-sized banks. On 25 October KELA counted 248 live domains impersonating 189 US financial institutions, most of them regional and commercial banks and lenders.
- Business accounts are a focus. Many captured pages are business banking or treasury portals, which KELA ties to larger balances and the ability to send wire and ACH transfers.
- The technique is known; the disguise is new. Push Security documents "dynamic IP locking", where a repeat visit gets a fake 404 or redirect. This cluster swaps the error for a believable hosting notice.
- The delivery channel is open. KELA has not tied one to the campaign, although the domain names point to bank-alert style messages.
See a lure like this caught: watch the explainer, or book a demo.
For the wider picture of AI-era email attacks, get the Q3 2026 State of the AI Attack report.
What is the Suspended phishing infrastructure?
KELA, a threat intelligence company, calls the cluster the "Suspended" infrastructure, after the page it shows returning visitors. Counting domains that have since gone offline, KELA has identified more than 300 domains in the same infrastructure since May 2026. A handful date to late 2025; most were registered between July and September 2026, with a peak in August.
A naming formula any bank fits
Most domains follow one pattern, [keyword]-[bank].com. The dominant keywords are secure, disable, protect and cancel, with authorize, terminate, credentials and commercial appearing less often. A smaller, growing group uses help-desk, live-support, treasury-portal and "primary device" names built on the bank's name, including help-desk and live-chat look-alikes of JPMorgan, Citi, BMO and Santander. About half of the 49 domains that went live in the week to 25 October use these newer templates.
Who is impersonated
KELA counts 189 US financial institutions, most of them mid-sized regional and commercial banks and lenders, plus a few large national banks; 183 still had a live look-alike on 25 October. Many of the captured pages are business banking or treasury portals. The hosting also connects to a backend that runs separate phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand, which KELA says points to either one operator running several campaigns or a phishing-as-a-service platform.
How do phishing sites evade takedown checks?
First visit: a bank login page
The first visit from an address gets a bank-branded form asking for a user ID and password, and some deployments show a reCAPTCHA first. The browser tab copies "Attention required", the title Cloudflare uses on its challenge page, and a script on the page blocks the browser's developer tools, which slows anyone trying to inspect it.
Any later visit: a closed hosting account
Any later visit from the same address gets "This account has been suspended". KELA says the page resembles the default notice a hosting provider shows after closing an account, down to a "Contact your hosting provider" link. In KELA's words, a victim typically follows a link once, while a scanner, a security team or a takedown provider checks a reported site and then checks it again to confirm. The second page is built for that second look.
Other decoys, same effect
In the week to 25 October some domains showed a "Sorry, you have been blocked" notice, a blank page or a redirect to Google instead, and some newer domains block traffic from anonymization networks. KELA notes that none of these responses on its own means a domain is inactive, and that public scan services capture only part of the campaign.
Why a fake takedown notice works
A takedown runs as report, check, confirm. The kit answers the confirm step. KELA puts it plainly: a takedown provider can mark a look-alike domain as down while it is still serving the phishing page to new visitors. Every domain sits behind Cloudflare, which issues the certificates and hides the origin servers, but some domains briefly resolved to their real servers, and those moments in historical DNS data let KELA trace two shared-hosting providers used one after the other.
The idea is older than this cluster. Push Security's phishing-technique reference describes dynamic IP locking as a one IP, one chance rule: the first visit from an address gets the phishing page and any later visit gets a fake 404 or redirect, so an analyst revisiting from the same machine sees nothing. AegisAI's reading is that the Suspended cluster improves on it. An error page invites a second look; a hosting suspension notice reads as the job done.
A suspended page is not a takedown. It may only mean the checker has been seen before.
AegisAI Threat IntelligenceWhy standard controls miss it
Verification tools see the second response. Any service or analyst that has already visited a domain gets the closed-account page, and KELA says public scan services capture only part of the campaign. Domain lists age quickly: in one week 49 new domains went live while 15 were taken down, and KELA says new ones appear daily.
The lure side is unknown, but the domain names suggest bank alerts about authorizing, cancelling or disabling something. AegisAI's reading is that such a message would point to a domain weeks old, served with a valid certificate from behind Cloudflare, with little reputation history for a filter to weigh.
How AegisAI stops this
KELA has not tied a delivery channel to this campaign. Where the link arrives by email, it reaches a mailbox before it reaches the look-alike site.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.
How AegisAI stops credential phishing, 48 seconds
Recommendations for defenders
- Before closing a takedown ticket, re-check the domain from a new IP address each time, not from an anonymization network, and repeat the check over several days, as KELA advises.
- Treat "This account has been suspended", "Sorry, you have been blocked", a blank page or a redirect to Google as unconfirmed, and ask the registrar, Cloudflare and the host to confirm the account is closed.
- Monitor new registrations that pair secure, disable, protect, cancel, authorize, terminate, credentials or commercial with the bank's name, plus help-desk, live-support and treasury-portal variants.
- Extend look-alike monitoring from retail login pages to business banking and treasury portals, and tell business clients how genuine security alerts reach them and where to report a look-alike.
- Hunt in DNS and proxy logs for the patterns below, and treat each matching domain as short-lived context, not a lasting blocklist entry.
FAQ
What is the Suspended phishing infrastructure?
It is KELA's name for a network of more than 300 look-alike domains, seen since May 2026, that impersonate 189 US financial institutions. Each site shows a bank login page on a visitor's first visit and a fake "This account has been suspended" hosting notice on any repeat visit from the same IP address.
Is a phishing site that shows "This account has been suspended" really down?
Not necessarily. In this campaign the notice may only mean your IP address has visited before. KELA advises checking from a new address each time, not through an anonymization network, and re-checking over several days before you treat the site as gone.
How do banks stop phishing sites that impersonate them?
Monitor for look-alike registrations that pair alert words such as secure, protect or cancel with your bank's name, including business banking and treasury variants. Report each one to the registrar, Cloudflare and the host, and confirm the takedown from fresh IP addresses over several days rather than with a single recheck.
How can a bank check whether its domain is impersonated?
KELA offers a free Bank Phishing Check: enter your bank's name or official domain to see whether it appears among the domains tied to this infrastructure as of 25 October 2026. Institutions on the list can contact KELA for specifics. Ongoing look-alike monitoring is still needed, since new domains appear daily.
For researchers
What the reporting does not tell us 4 gaps
Victims. KELA gives no count of victims, stolen credentials or losses.
Delivery. KELA has not tied a delivery channel to the campaign. The bank-alert wording of the domain names is the only hint.
Operator. KELA leaves open whether one operator runs several campaigns or a phishing-as-a-service platform serves many. It traced operator access to a UK home broadband connection and treats that as a lead only.
IP memory. Neither KELA nor Push states how long the kit remembers an address, so it is unknown whether a check from the same address weeks later would see the login page again.
Indicators published by KELA page strings and domain patterns
These come from KELA's report. Domains are written with [.] so they cannot be clicked. The cluster adds and loses domains every week, so treat them as hunting patterns, not a live blocklist.
| Type | Indicator |
|---|---|
| First-visit tab title | Attention required |
| Repeat-visit page | This account has been suspended with a Contact your hosting provider link |
| Other decoys | Sorry, you have been blocked, a blank page, or a redirect to Google |
| Main domain pattern | [keyword]-[bank].com; keywords secure, disable, protect, cancel, and less often authorize, terminate, credentials, commercial |
| Newer pattern | help-desk, live-support, treasury-portal and "primary device" names built on the bank's name |
| Example domains | protect-pinnaclefp[.]comauthorize-valley[.]comcommercial-atfirst[.]com53primaryset[.]com |
| Hosting | Behind Cloudflare; origins on two shared-hosting providers, used one after the other |
MITRE ATT&CK mapping 4 techniques
This mapping is AegisAI's own reading of the reported behaviour. KELA's report lists no technique IDs.
| ID | Name | Use in this campaign |
|---|---|---|
T1583.001 | Acquire Infrastructure: Domains | More than 300 look-alike domains since May 2026, most following a keyword-bank-name formula. |
T1608.005 | Stage Capabilities: Link Target | Bank-branded login pages staged on those domains as the destination of a link. |
T1684.001 | Social Engineering: Impersonation | Pages copy bank branding, Cloudflare's challenge title and a hosting provider's suspension notice. |
T1480 | Execution Guardrails | The live page is served only to an IP address that has not visited before. |
References 3 sources
- KELA Cyber Intelligence Center (updated 3 Nov 2026). Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown. kelacyber.com
- Push Security (28 Aug 2025). Single-use links, Phishing Detection Evasion Techniques. phishing-techniques.pushsecurity.com
- MITRE ATT&CK. Techniques T1583.001, T1608.005, T1684.001 and T1480. attack.mitre.org
Every email, investigated.
See how AegisAI reads a bank alert like this one and pulls it from inboxes before anyone clicks.
Attacks like this one, stopped before the inbox.
Book a demoRelated posts
More from the AegisAI blog.