Bank Phishing Sites Use Fake Suspended Pages to Evade Takedowns

Summary

Kela reports that a bank-phishing campaign uses more than 300 look-alike domains and serves fake suspended-account pages to repeat visitors, potentially making active phishing sites appear taken down to scanners.

Key points

Kela says the campaign has been active since May and uses more than 300 fake domains, including 248 impersonating 189 US financial institutions.
The phishing kit remembers visitors' IP addresses: first-time visitors see bank login pages, while return visitors see fake suspended-account notices.
Kela reports that the campaign primarily targets business banking and treasury logins; it has not determined how victims are directed to the pages.
The sites use bank-branded login pages that request user IDs and passwords, and may display a reCAPTCHA.
The fake suspended pages can mislead scanners and takedown providers checking a site more than once; Kela says each check needs a new IP address to see the live phishing page.
Kela traced some domains to their hosting after they briefly resolved to real servers, finding targeting of the UK, Australia, and New Zealand as well.

Article Details

Event Type: Phishing campaign using fake suspended-account notices to conceal active bank phishing sites from repeat visitors and takedown checks.
Impact: Kela reports that the campaign has used more than 300 fake domains, including 248 impersonating 189 US financial institutions. As of October 25, 183 targeted organizations still had live look-alike sites. The pages seek banking credentials, with business banking and treasury logins the primary focus; victims in the UK, Australia, and New Zealand are also targeted.