A recent analysis by cybersecurity firm Kela reveals that cybercriminals are deploying fake ‘suspended account’ alerts on phishing sites to obscure their activities. These fraudulent websites, mimicking legitimate bank interfaces, aim to deceive returning users by displaying these alerts, which suggest the account is no longer active.
Growing Threat of Fake Domains
Since May, the scheme has leveraged over 300 counterfeit domains to impersonate a range of financial institutions, particularly in the United States. Initially appearing in late 2025, the majority of these domains were registered between July and September 2026. As of late October, 183 banks were still being targeted, with a focus on regional banks.
The phishing operation continues to expand, evidenced by 49 new domains surfacing just last week. A common characteristic among these domains is the use of certain keywords such as ‘secure’, ‘disable’, and ‘protect’, followed by the bank’s name, which helps the sites appear more legitimate to unsuspecting users.
Mechanics Behind the Deception
Central to this operation is an intelligent mechanism that distinguishes between first-time and returning visitors. On initial visits, users encounter a convincing bank login page. However, should they return, they are met with a page that resembles a hosting account suspension notice. This tactic is strategically designed to mislead those investigating the site, such as security teams and takedown services, into thinking the site is no longer active.
Intriguingly, about half of the newly identified domains employ terms like ‘help-desk’ and ‘live-support’ to further the deception, with some impersonating major banks such as JPMorgan and Citi. The primary targets for these phishing efforts are business banking and treasury services, rather than individual accounts.
Challenges in Combatting the Phishing Campaign
Despite efforts to combat such phishing tactics, several aspects make this campaign particularly resilient. The simplicity of the domain naming strategy allows for easy replication across various banks. Utilizing Cloudflare services obfuscates the true hosting locations, making it harder for cybersecurity professionals to pinpoint and dismantle the infrastructure.
Moreover, the use of shared servers and evasion tactics, such as the fake ‘suspended’ page, complicates the takedown process. Although some domains briefly reveal their true servers, enabling tracing, these instances are fleeting, allowing the campaign to continue targeting regions like the UK, Australia, and New Zealand.
Understanding these sophisticated methods highlights the ongoing battle against phishing threats and underscores the need for vigilant cybersecurity measures. As attackers refine their techniques, it remains crucial for financial institutions and users alike to stay informed and cautious.
