Skip to content
Phishing Scam Fakes Takedown Notices to Evade Detection

Phishing Scam Fakes Takedown Notices to Evade Detection

First seen 3 Nov 2026, 16:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 18:16 UTC
  • •248 fraudulent domains impersonating 189 US banks identified.
  • •Scammers display fake 'account suspended' pages to evade detection.
  • •New domains are rapidly created to replace taken down ones.

KELA researchers have identified a phishing network impersonating 189 US banks, utilizing 248 fraudulent domains. This campaign employs a unique tactic of displaying fake 'account suspended' pages to mislead security scanners and victims. The domains follow a specific naming convention, incorporating urgency keywords and the bank's name. By using Cloudflare to obscure their infrastructure, the scammers can create new domains rapidly after takedowns. Victims are still directed to cloned websites, while scanners are tricked into believing the sites are inactive. This ongoing operation highlights the sophistication of modern phishing tactics and the need for vigilant monitoring by financial institutions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-25
KELA reports phishing network
KELA researchers disclosed the existence of a phishing infrastructure with 248 domains targeting US banks.
Zdnet

More articles in this cluster (2)

Following this threat?

Track Cloudflare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

How can I check if my bank is affected?
Use KELA's Bank Phishing Check tool by entering your bank's official domain or name.
What should I do if I encounter a suspicious domain?
Report the domain to the registrar and to Cloudflare, and verify its activity over time.
What keywords should I watch for in phishing domains?
Look for urgency keywords like secure, disable, protect, or cancel followed by a hyphen and your bank's name.