A $25 template helped scammers build hundreds of phantom bank domains
Allure Security researchers found 838 live phantom bank sites sharing a $25 template, built to lend credibility to investment and romance scams.
Allure Security researchers discovered roughly 2,200 domains presenting invented banks, of which 1,095 returned working pages and 838 contained a shared phrase. 97% of those retained parts of the $25 Cuex front-end template and 94% ran Laravel, with a misspelled 'Curreny Charts' heading on 90% of sites. The sites presented login pages, session cookies, and anti-forgery tokens consistent with a fraud model where scam contacts direct victims to fake financial portals. A leftover 'Remedy bank' title and form submission to remedycodes[.]site linked some sites to already-flagged fraud infrastructure.
- 810 of 838 live phantom bank sites reused the $25 Cuex template
- Laravel was present on 94% of the sites; login pages on 770
- Researchers call the credibility-building pattern 'legitimacy stacking'
- A 'Remedy bank' leftover and shared form endpoint linked sites to known fraud
- Shared typos, cookies, and form destinations aid detection of phantom banks
- ATT&CK
- T1656 Impersonation
- Vendors
- Allure Security
- Products
- Cuex templateLaravel
- Victims
- Classtands Crest
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | classtandscrest.com | ewhere for suspected fraud. The public registration page at classtandscrest[.]com (Source: Allure Security) What to check Researchers recom |
| domain | remedycodes.site | n form was set to send submitted data to a separate domain, remedycodes[.]site. Researchers did not submit the form. That same Remedy ad |
From the original article
2 min read at helpnetsecurity.com
A phrase on a suspicious website turned into an investigation of phantom banks built to support scams , according to new research from Allure Security. Molly DeQuattro , the company’s VP of Operations, was reviewing a domain that resembled the brand of one of its financial services clients. The page carried none of that client’s branding.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.