'Suspended' Phishing Kit: US bank look-alike domains — serve phishing to first-time visitors, fake 'suspended' pages to evade takedowns (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-11-05
Kela reports a phishing campaign, active since May 2026, using 300+ domains (248 impersonating 189 US financial institutions, mostly mid-sized regional banks) that target business banking and treasury logins. The kit remembers each visitor's IP: first-time visitors get a bank-branded login page (with reCAPTCHA, Cloudflare-style 'Attention required' title, and anti-devtools script), while repeat visitors see a fake 'This account has been suspended' hosting notice — fooling scanners and takedown providers into marking live sites as down. Domains sit behind Cloudflare; some also redirect to Google or serve other fake notices. Victims in the UK, Australia and New Zealand are also targeted. 49 new domains appeared in the week to October 25. No fix applies; detection and takedown require fresh IPs per check.
What to do
- Warn business banking and treasury staff about look-alike domains using keywords like 'secure', 'help-desk', 'live-support' plus the bank name; verify URLs before entering credentials
- Enforce phishing-resistant MFA and FIDO2 keys on business banking and treasury accounts
- Monitor for credential reuse from users who may have entered logins on these pages; reset exposed credentials
- Block/monitor the reported look-alike domains at DNS and proxy level
- When checking reported phishing sites, use fresh IP addresses/VPNs per check and share IOCs with takedown providers and the banks' security teams
Sources
All live incidents on Threat Watch
