Kela Exposes Bank Phishing Sites Faking Suspended Pages

Cybersecurity firm Kela reports a bank-phishing operation that uses fake ‘suspended’ notices to hide content from visitors who return to look‑alike bank sites. The campaign, active since May, has registered more than 300 fake domains, including 248 impersonating 189 US-based financial institutions. The earliest registrations date to late 2025, but the majority appeared between July and September 2026.

As of 25 October, 183 targeted organisations still had live look‑alikes, with 49 new domains going live in the prior week. Kela notes the infrastructure is designed to frustrate takedowns: the kit remembers a visitor’s IP address so a first visit shows a bank login page, while a return visit displays a page stating the account has been suspended, mimicking a hosting provider’s closed‑account notice.

This “Suspended” infrastructure is used to mislead takedown scanners into marking a domain as down even though it still serves phishing content to fresh visitors.

Most domains adopt a naming pattern with words like secure, disable, protect, cancel, authorise, terminate, credentials, or commercial followed by the bank’s name; a growing subset uses help-desk, live-support, treasury-portal, or primary device labels built on the bank’s branding.

While the campaign largely targets business banking and treasury logins rather than personal accounts, the sites sit behind Cloudflare, with some briefly resolving to their real servers, allowing researchers to trace hosting and confirm UK, Australian, and New Zealand victims. Four factors enable its persistence: a repeatable naming scheme, Cloudflare shielding, a return‑visit fake‑suspended page that sustains a live domain’s appearance, and shared servers that outlast individual domains. Ionut Arghire reports for SecurityWeek.