Bank phishing kit shows fake 'suspended' page to anyone who checks twice

Kela has published research on a phishing cluster it calls the "Suspended" infrastructure: look-alike bank sites that remember a visitor's IP address and serve a login page the first time, then a fake "This account has been suspended" notice on any return visit. SecurityWeek reported the findings on November 5.

The campaign has been active since May and has leaned on more than 300 fake domains, including 248 impersonating 189 US financial institutions. The first were registered in late 2025, but most appeared between July and September 2026. As of October 25, 183 of the targeted organisations still had live look-alikes, mostly mid-sized regional banks. Forty-nine new domains turned up in the week to that date.

The design is aimed at the people who could get a site pulled. A victim follows a link once. A scanner or takedown provider checks a reported site, then checks again to confirm, and the second check shows what looks like a completed takedown. Kela notes that seeing the live content requires a new IP address for every check.

First-time visitors get the bank's branding, a request for a user ID and password, and sometimes a reCAPTCHA. The tab title reads "Attention required", borrowed from Cloudflare's challenge page, and a script blocks developer tools. Some domains served other fake notices or redirected to Google instead.

Kela hasn't established how victims are lured in. It did conclude the campaign mostly targets business banking and treasury logins rather than personal accounts. The domains sit behind Cloudflare, though some briefly resolved to their real servers, which let Kela trace the hosting and find victims in the UK, Australia and New Zealand as well.

For defenders, the practical point is that a single check of a reported domain proves little. Re-checking from a different address, or treating a "suspended" page as unconfirmed rather than resolved, is the difference between closing a case and closing nothing. Business banking and treasury staff are the ones worth warning.