A phishing operation targeting U.S. financial institutions is using fake hosting-suspension notices to conceal active login pages from security teams and takedown providers, according to research from KELA. The campaign had 248 live domains impersonating 189 financial institutions as of Oct. 25, while more than 300 related domains had appeared on the same infrastructure since May.
The deception is based on visitor tracking. On a first visit, the sites present cloned bank login pages, including business-banking and treasury portals that request company identifiers, user IDs and passwords. When the same IP address returns, the phishing kit instead displays a page resembling a legitimate hosting-provider notice stating that the account has been suspended. Some domains showed blocking notices, blank pages or redirects to Google as alternative decoys.
That behavior directly undermines common validation procedures. A victim may visit once and submit credentials, while a researcher, scanner or takedown provider that checks the reported domain again sees only an apparently disabled site. KELA said investigators need to test from a fresh IP address and continue checking over time; a single “suspended” response does not establish that the phishing content has been removed.
Most of the identified targets are U.S. regional and commercial banks, and many of the cloned pages focus on business accounts. The domains commonly combine urgency-related terms such as secure, disable, protect or cancel with a bank’s name, a pattern that can help defenders identify newly registered look-alikes. KELA said the institutions were impersonated rather than breached, and it did not identify a confirmed operator.
The infrastructure also complicates remediation. The domains are fronted by Cloudflare, which obscures their origin servers, while the underlying hosting is shared with unrelated websites. KELA found evidence linking the servers to additional phishing activity aimed at banks, cryptocurrency exchanges and government services in the United Kingdom, the Netherlands, Australia and New Zealand, consistent with either a single operator or a phishing-as-a-service setup.
Financial institutions should prioritize newly registered domains matching the campaign’s naming patterns, verify reported sites from multiple networks and notify registrars, Cloudflare and hosting providers when live phishing content is confirmed. Banks should also warn customers—particularly business-account users—to access services through a known app or saved address and to verify unexpected requests to authorize, cancel or “secure” transfers through established contact channels rather than links in messages.
