Key points
- The infrastructure linked 248 phishing domains to 189 major US banks as of 25 October 2026.
- Fake suspension pages appear only on a visitor’s second request, hiding the scam from initial scans.
- Researchers suspect a single operator or a wider phishing-as-a-service platform runs the setup.
KELA researchers reported an active financial-scam infrastructure that hides behind fake suspension notices to evade detection by security scanners and automated tools.reported This technique allows fraudulent sites to remain online while targeting victims who do not see the takedown warning.Scammers are showing fake takedown messages to security tools while keeping their sites open for victims.The infrastructure employs conditional rendering based on visitor history to bypass static scanning heuristics.
The claim
According to a report by KELA researchers, the operation known as “Suspended” hosts hundreds of cloned websites targeting business banking services.reported As of 25 October 2026, analysts linked 248 financial scam domains to 189 major US banks and financial institutions using this shared infrastructure.reported
Evidence: reported
This clever banking scam keeps phishing by faking its own demise – how it worksaifleet-zdnet
Evidence: reported
This clever banking scam keeps phishing by faking its own demise – how it worksaifleet-zdnet
The response
The researchers noted that the backend relies on a small number of servers across two shared hosting providers. They observed connections to phishing campaigns against cryptocurrency exchanges and government services in the UK, Netherlands, Australia, and New Zealand, suggesting broader operational reach.
The bottom line for teams
Analysts believe either a single operator controls the setup or the server infrastructure forms part of a larger phishing-as-a-service platform. The use of common keywords like “secure” and “disable” in domain names aims to mimic legitimate banking communications.
What the paper shows
The report describes how phishing kits manipulate visitor experience to bypass automated security checks. Observations indicate that domains register visitor IP addresses and display a fake “account suspended” page only on the second visit. This limits scanner visibility while maintaining access for targeted victims.
Why it matters
- Evaluators must account for dynamic content that changes based on visit frequency when testing detection accuracy.
- Static domain reputation checks may fail if infrastructure rotates or uses conditional responses to hide malicious intent.
- Business banking sectors face targeted risks from sophisticated cloning techniques that mimic official communication styles.
- Shared hosting environments can host multiple unrelated phishing campaigns, complicating attribution and takedown efforts.
Topics: phishing, infrastructure, detection evasion, business banking, KELA
Updated
For readers
Researchers
- Focus on conditional response testing to detect visitor-triggered content changes.
- Investigate shared hosting providers linked to multi-campaign phishing operations.
Business
- Review business banking phishing trends involving cloned domains with security keywords.
- Implement second-request monitoring to identify sites hiding behind fake suspensions.
Consumers
- Be wary of banking emails directing you to domains with words like disable or protect.
- Verify bank URLs directly rather than clicking links in unexpected communications.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
How does the fake suspension notice work?
The phishing kit records the visitor's IP address and shows a fake takedown page only when the same visitor returns for a second visit.
Which regions are targeted by this infrastructure?
The infrastructure targets US banks, plus government services and crypto exchanges in the UK, Netherlands, Australia, and New Zealand.
How many domains were identified in the report?
Researchers linked 248 financial scam domains to 189 major US banks and financial services as of 25 October 2026.
Connected stories
Reading receipt
- The infrastructure linked 248 phishing domains to 189 major US banks as of 25 October 2026.
- Fake suspension pages appear only on a visitor’s second request, hiding the scam from initial scans.
- Researchers suspect a single operator or a wider phishing-as-a-service platform runs the setup.