Bank Phishing Sites Use Fake Suspended Pages to Evade Takedowns
Original title: Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
Kela reports over 300 look-alike domains targeting 189 US banks and other regions use IP-based switching between login pages and fake suspended notices to survive takedowns.
A threat actor has used more than 300 fake domains impersonating US financial institutions since late 2025 to conduct phishing. The campaign targets business banking and treasury logins at mid-sized regional banks. Sites serve login pages on first visits and suspended account notices on revisits to evade detection. Many domains follow naming patterns with keywords like secure or cancel followed by the bank name.
Unconfirmed: How victims are initially lured to the sites is not discovered
- 248 domains impersonate 189 US financial institutions
- 183 still live as of October 25 2026
- 49 new domains appeared in the week to October 25
- Targets primarily business banking rather than personal accounts
- Sites use Cloudflare and block developer tools
Impact: phishing credentials from targeted bank accounts
- 1.Monitor for look-alike domains using bank names with keywords like secure or cancel
- 2.Check Cloudflare-protected sites for suspended page redirects
- 3.Verify visitor IP behavior on suspected phishing domains
- Vendors
- Kela
- Countries
- USUKAustraliaNew Zealand
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trigger.dev | es Related: AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks Related: AI-Powered Phishing Platform EvilTo |
From the original article
2 min read at securityweek.com
More than 200 sites were seen serving phishing content to first-time visitors but not to those who revisit. The post Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.