Phishing Infrastructure Fakes Suspensions to Evade Detection
Cybercriminals use deceptive takedown notices to trick security scanners and maintain fraudulent operations.
1Sophisticated Phishing Infrastructure Exposed
KELA researchers identified a massive phishing operation hosting 248 active domains as of October 25, 2026. These sites impersonate 189 major US financial institutions, specifically targeting business banking users. The infrastructure utilizes shared hosting providers to maintain a persistent presence while expanding its reach into cryptocurrency exchanges and various government services globally.
2The Fake Suspension Mechanism
The attackers employ a clever evasion tactic by displaying fake suspension notices to security scanners. The phishing kit tracks visitor IP addresses and triggers a deceptive 'account suspended' page upon the second visit. This mimics legitimate challenge pages, effectively convincing automated security tools and human analysts that the malicious site is already offline.
3Targeting Security Teams Directly
By simulating a completed takedown, the operators specifically target the workflows of security teams and takedown providers. Since these entities often verify reported sites through repeated checks, the fake suspension notice serves as a successful deterrent. This allows the fraudulent content to remain accessible to actual victims while appearing inactive to investigators.
4Technical Evasion and Decoys
Beyond fake suspension notices, the phishing kits utilize various decoys like blank pages, 'blocked' notifications, and redirections to Google. The attackers also implement scripts that block browser developer tools to hinder manual analysis. These layers of obfuscation are designed to slow down security researchers and prolong the lifespan of the malicious domains.
5Scale of the Operation
Since May, over 300 unique scam domains have been hosted on this specific infrastructure. Despite ongoing efforts to report these sites to law enforcement, the campaign remains highly active with new domains appearing daily. The persistence of this operation suggests either a single dedicated operator or a sophisticated phishing-as-a-service platform model.
6Potential Operator Footprint
Researchers identified a possible lead involving a remote desktop connection to the malicious infrastructure. This connection originated from a standard UK home broadband link, though this detail remains unverified. Such a connection point might indicate the physical location of the operator, providing a rare glimpse into the human element behind the automated scam.
7Global Reach and Impact
The campaign extends well beyond the United States, impacting users in the UK, the Netherlands, Australia, and New Zealand. By cloning official banking domains and using keywords like 'secure' or 'protect,' the attackers create highly convincing lures. This global scope highlights the systemic risk posed by centralized phishing-as-a-service platforms targeting financial services.
8Defensive Measures and Verification
To combat these threats, KELA has released a free Bank Phishing Check tool for organizations to verify official domains. Users are advised to utilize phishing link checkers and remain skeptical of unsolicited banking communications. Vigilance is essential, as a single interaction with these cloned sites can lead to severe financial fraud and identity theft.
Original article: Latest news — Phishing Infrastructure Fakes Suspensions to Evade Detection