Kela notes

A bank phishing campaign of 248 live look-alike domains shows anyone who checks twice a fake “account suspended” page, while first-time visitors still reach the fake login. Here is how it works, how to spot the wave, and how to check if your bank is targeted.

KELA’s Cyber Intelligence Center (CIC) is a dedicated team of expert threat intelligence analysts who conduct deep investigations and analysis to support clients with customized, actionable intelligence. The CIC empowers KELA customers with high-value insights derived from dark web monitoring, cybercriminal communities, and exclusive intelligence sources.

Updated November 3, 2026

Every analyst knows the “suspended” page. It means a registrar or host got there first and the phishing site is gone. Here, nobody suspended anything. The phishing kit shows that notice itself to anyone who comes back for a second look, and keeps serving the bank login to first-time visitors.

Over the past two months, KELA’s ongoing monitoring has flagged a growing number of look-alike bank domains named in the same style. Investigating them uncovered a single campaign that, as of October 25, 2026, includes 248 live phishing domains impersonating 189 US financial institutions, 183 of which still had live look-alikes on that date. Counting domains that have since gone offline, KELA has identified more than 300 domains in the same infrastructure since May 2026, and new ones appear daily. What ties them together is one mechanism: the kit remembers every visitor’s IP address, so the first visit gets a bank login page and any return visit gets what looks like a closed hosting account. We call this cluster the “Suspended” infrastructure.

This piece lays out what the infrastructure looks like from the outside, what sits behind it, and how defenders, brand-protection teams and banks can recognize it before the wave registers.

Responsible disclosure: KELA communicated these findings to the relevant parties, including law enforcement and intelligence agencies and the affected organizations, before publication. The financial institutions mentioned in this research were impersonated, not breached.

Check exposure directly in KELA’s free Bank Phishing Check

Scale: As of October 25, 2026, the campaign includes 248 live domains impersonating 189 US financial institutions (183 with live look-alikes on October 25), out of more than 300 identified since May 2026. Most targets are mid-sized regional banks.

Naming formula: Most domains follow the same recipe, [keyword]-[bank].com, with keywords such as secure, disable, protect and cancel, which makes the cluster findable in newly registered domain feeds.

Business banking focus: Many of the cloned pages are business banking and treasury logins, not personal accounts.

Cloaking: A second visit from the same IP address gets a fake “account suspended” page, so a live domain can look dead to scanners and takedown teams. Some domains now use other decoys too, such as a blocking notice, a blank page or a redirect to Google.

Hosting: Brief gaps in Cloudflare’s cover exposed the real servers: a handful of addresses with two shared-hosting providers, used one after the other.

Shared backend: The hosting connects to a backend that also runs phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand, which points to a single operator or a phishing-as-a-service platform.

Operator access: A management server set up on October 9 logs into the control panel of the US-bank hosting, and all backend hosts are managed over SSH from a single jump server, reached over Remote Desktop from a UK broadband connection. This is the strongest lead to the operator so far.

All 189 impersonated brands are US financial institutions. A few are large national banks, but most are mid-sized regional and commercial banks and lenders. For institutions of that size, a domain that looks dead to scanners can easily slip past routine monitoring.

The campaign isn’t limited to retail logins: many of the pages we captured are business banking or treasury portals. Business accounts hold larger balances and can send wire and ACH transfers, so their credentials are worth more to an attacker.

The most visible trait of this campaign is how the domains are built. Most follow a single pattern:

[urgency keyword] – [bank name] .com

Keywords: the dominant ones are secure, disable, protect and cancel, with authorize, terminate, credentials and commercial appearing less often.

Structure: names are short, carry a single hyphen, and rarely contain long digit strings.

Business templates: a smaller, growing group uses help-desk, live-support, treasury-portal and “primary device” names built on the bank’s name. half of the 49 domains that went live in the week to October 25 use these templates, including help-desk and live-chat look-alikes of JPMorgan, Citi, BMO and Santander.

Taken together, the keywords read like the subject line of a bank alert: a transfer waiting to be authorized, a payment that needs to be cancelled, an account to be disabled. KELA has not tied a specific delivery channel to the campaign, so how victims reach these sites remains open, but the domain names point to messages of this kind.

Figure 1. Only the keyword, session ID and bank name change from one domain to the .

Registration Timeline

Registrations came in waves. A handful of domains date to late 2025, but most were registered between July and September 2026, with a peak in August, and several domains for the same bank were often registered on the same day. The campaign is still growing: in the week to October 25, 49 new domains went live, among them 53primaryset[.]com, a look-alike of Fifth Third Bank’s business banking, while 15 were taken down. Over the same week, the number of impersonated institutions rose from 165 to 183.

“Attention required” title: The browser tab copies the title Cloudflare uses on its challenge page, so a visitor glancing at the tab sees what looks like a routine security check. Meanwhile, the page itself carries bank branding, such as the FDIC insurance banner.

Figure 2. The tab title copies Cloudflare’s “Attention required” challenge page, while the page itself shows bank branding.

Tokenized sign-in path: Victims are sent to a sign-in path with a long session token in the URL. Some deployments use an /auth/login.php path instead.

Figure 3. Business banking login page served by the kit, with Company ID, User ID and Password fields (bank branding redacted).

reCAPTCHA gate: Some deployments show a reCAPTCHA before the form.

Anti-inspection code: The pages load a script that blocks the browser’s developer tools, which slows down anyone trying to inspect them.

The Fake “Suspended” Page

The kit’s most effective feature is what it shows on a second look. It records the IP address of every visitor. The first visit from an address gets the login form; any later visit from the same address gets a “This account has been suspended” page instead. It resembles the default notice a hosting provider shows after closing an account, down to the “ your hosting provider” link.

That design targets exactly the people who could shut a site down. A victim typically follows a link once. A scanner, a security team or a takedown provider checks a reported site, then checks it again to confirm, and the second check shows what looks like a completed takedown. In practice, a takedown provider can mark a look-alike domain as down while it is still serving the phishing page to new visitors. Seeing the live content requires a new IP address for every check.

Because the same suspended page appears across many domains in the campaign, seeing it on a newly registered bank look-alike is a reason to look closer, though not proof on its own, since hosting providers use similar pages. It is also not the only decoy: in the week to October 25, some domains showed visitors a “Sorry, you have been blocked” notice, a blank page or a redirect to Google instead, and some newer domains block visitors more aggressively, including traffic from anonymization networks. None of these responses means on its own that a domain is inactive.

The cloaking also means public scan services capture only part of the campaign. Some of the domains KELA flagged have no public scan record at all, including protect-pinnaclefp[.]com, targeting Pinnacle Financial Partners, authorize-valley[.]com, targeting Valley National Bank, and commercial-atfirst[.]com, targeting First Financial Bank.

Figure 4. Two responses from the campaign: the fake “account suspended” page shown to returning visitors, and the login page shown on a first visit.

Behind Cloudflare: Origin Servers and a Shared Backend

Every domain sits behind Cloudflare, which issues the certificates and hides the origin servers, but its cover isn’t complete. Over the campaign’s lifetime, some domains briefly resolved to their real servers instead of to Cloudflare. Tracking those moments in historical DNS data let KELA trace where the sites are actually hosted.

The origin servers sit with two shared-hosting providers, used one after the other: the first from May to August 2026, then a shared cPanel server at a second provider from September. In both cases the campaign occupies only a handful of addresses, each shared with hundreds of unrelated websites, and the same lure domains moved from the first provider to the second. One of the origin servers was still serving US-bank domains on October 20.

Network telemetry for the origin servers, and for the hosts they talk to, points to four more hosts, all active in October:

Backend server: A cloud server that the US-bank origin connects out to from October 10 onward. It manages the phishing front-end over SSH and, for a few days, served phishing pages of its own.

Phishing front-end: A cloud virtual machine that took over the backend’s phishing domains on October 11 and still serves them. It also polls the US-bank origin over HTTP, consistent with checking whether the site is up.

Management “bot” server: A cloud server set up on October 9 under a subdomain named “bot” of a domain on the backend server. Since that evening it has logged into the control panel (WHM) of the server that hosts the US-bank origin.

Jump server: A server at the second hosting provider, probably running Windows. It opens SSH sessions to each of the three hosts above and is itself reached over Remote Desktop.

Figure 5. How the hosting and backend connect, as of October 2026. Arrows show the direction of observed connections.

The backend pair and the hosting behind the campaign also serve phishing outside the US-bank campaign, aimed mostly at retail customers in other countries: look-alikes of HSBC, NatWest, HMRC and a UK parcel-delivery service in the UK; Bitvavo and ABN AMRO in the Netherlands; CoinSpot and Australia Post in Australia; and ASB Bank in New Zealand. That points to either a single operator running several campaigns or a phishing-as-a-service platform hosting several customers on common infrastructure, and the evidence so far does not separate the two. No operator identity has been confirmed (the closest lead is described below), and KELA has not found the kit advertised or discussed in the underground sources it monitors.

The backend also shows how the operation is managed. On October 9, a new domain was set up on the backend server. That evening, at 18:51 UTC, a subdomain of it named “bot” began pointing to a separate cloud server, and 20 minutes later that server started logging into the control panel of the US-bank origin. The sessions continued through October 26. The pattern fits automated management of the hosting account, such as setting up new phishing sites, although that purpose is not confirmed.

All of these hosts are managed from one place: a jump server at the second hosting provider, probably running Windows. It opens SSH sessions to the backend server, the management server and the phishing front-end. Because the same machine reaches both the server that manages the US-bank hosting and the front-end for non-US phishing, both lure sets appear to be administered from one place. That fits a single operator, although the administrator of a phishing-as-a-service platform would look the same. The jump server also connects to Telegram data centers; the traffic does not show whether a person or an automated client is behind it.

The jump server, in turn, is reached over Remote Desktop from a residential broadband connection in the UK, on 10 days between October 11 and 20. The same connection also reached the backend server directly, and almost all of its observed traffic goes to this infrastructure. IP reputation services list it as an ordinary connection, not a VPN, proxy or hosting address. It is the strongest lead to the operator found so far. The network data covers only a sample of traffic, and a connection can be used by someone else as a proxy, so this is a lead rather than an identification.

At the same hosting provider, a web server with no public domains is visited in short bursts, mostly between 05:00 and 07:00 UTC, on 11 days between October 6 and 26. The visits come through Mullvad VPN and Tor exits, and from the same UK connection. The pattern suggests a panel that someone checks routinely while hiding their address.

Mid-May 2026: Earliest related activity, with the first hosting provider.

August: Peak in new domains; 134 of the 214 domains live on October 17 were first seen this month.

September: Hosting moves to the second provider, and lure domains move with it.

Late September to early October: Business banking and treasury look-alikes go live with the second provider.

October 8: Backend server comes online and briefly serves non-US phishing domains.

October 9: Management domain set up on the backend; the new “bot” server starts logging into the US-bank origin’s control panel.

October 10 to 11: The US-bank origin starts calling the backend; the front-end VM takes over the backend’s phishing domains.

October 11 to 20: Remote Desktop sessions from a UK broadband connection to the jump server, on 10 days.

October 17: 214 live domains counted.

October 19 to 21: New US-bank domains go live; hosting, backend and front-end are still active.

October 25: 248 live domains impersonating 183 institutions (189 targeted in total), with 49 new and 15 taken down since October 17; new decoy pages in use.

October 26: Backend, management server, front-end and jump server still active.

Why Takedowns Fall Short

Four things make this infrastructure hard to stop: a naming formula simple enough to repeat for any bank; Cloudflare, which hides where the sites are hosted; a kit that shows anyone checking twice a fake “suspended” screen, so a live domain can pass for an inactive one; and shared servers that outlast any single domain. The key point is that a takedown removes one look-alike while the servers behind it keep serving the rest: the origin that hosted US-bank look-alikes in early October was serving a new one on October 20.

What Defenders Should Do

Watch the naming recipe: In newly registered domain feeds, treat .com domains that combine secure, disable, protect, cancel, authorize, terminate or credentials with your bank’s name, or a customer’s, as high priority, along with help-desk, live-support, treasury and “primary device” names built on it. Confirm by page behavior before attributing a domain to this campaign, since other operations use similar words.

Don’t clear a domain after one visit: A “suspended” response may only mean your IP address has visited before, and a blocking notice, a blank page or a redirect to Google can hide a live page in the same way. Check from a new address each time, preferably not from an anonymization network, and re-check over several days.

Confirm the site is actually down: Report to the registrar, to Cloudflare and, where the origin is known, to the hosting provider, then check from a fresh IP address that the phishing page is actually gone. A provider that only sees a decoy page may close the report as resolved. The origin servers are shared, so blocking their IP addresses outright will also block unrelated sites.

Warn business banking customers: A message asking them to cancel or authorize a transfer through a link matches the themes in this campaign’s domain names. Customers should confirm through the bank’s known phone number or app, not through the link.

Check exposure directly: Enter a bank’s name or official domain in KELA’s free Bank Phishing Check to see whether it appears among the domains KELA has tied to the Suspended infrastructure as of October 25, 2026. Institutions that find themselves on the list can KELA for the specific domains impersonating them, along with the origin servers, backend and management addresses behind the campaign.

KELA continues to track the Suspended infrastructure and will update this research as new domains and kit variants appear.