Phishing
Bank phishing sites that fake their own takedown
KELA found 248 live look-alikes of 189 US banks that show a fake suspended page to anyone checking twice. How the kit works and how to verify a takedown.
Threat intelligence firm KELA has published research on a phishing network that copies the business banking logins of US banks and then hides from the people trying to remove it. On October 25, 2026, KELA counted 248 live domains impersonating 189 US financial institutions, and 183 of those institutions still had at least one live look-alike. Most targets are mid-sized regional and commercial banks and lenders. Counting domains that have since gone offline, KELA has tied more than 300 domains to the same infrastructure since May 2026.
The trick that matters is in the kit. A first visit gets the bank login. A second visit from the same IP address gets a page saying "This account has been suspended". Takedown providers and security teams usually re-check a reported site before closing the case, so the re-check shows what looks like a finished takedown while new victims still get the login form. If you run brand protection for a bank, or you sign in to business banking for your company's treasury, this affects you.
How the kit decides what you see
The kit logs every visitor's IP address. A new address is sent to a sign-in path with a long session token in the URL (some deployments use /auth/login.php). The page is a generic Bootstrap form asking for user ID and password, with the bank's logo, imagery and footer links copied from the real site, and an FDIC insurance banner. Business versions add a Company ID field. Some deployments put a reCAPTCHA in front of the form, and a script blocks the browser's developer tools to slow down anyone inspecting it. Submitted credentials are posted to a script on the same domain.
The browser tab reads "Attention required", the title of Cloudflare's challenge page, so a quick glance at the tab looks like a normal bot check. Any later visit from a logged address gets the suspension notice, with a "Contact your hosting provider" link copied from a hosting provider's default closure page. In the week to October 25, KELA also saw other decoys: a "Sorry, you have been blocked" notice, a blank page and a redirect to Google. Some newer domains block traffic from anonymization networks, which defeats the obvious workaround of checking through a VPN or Tor exit.
Public URL scanners hit the same wall. Once one scan has logged the scanner's address, the next scan through that address records a dead site, and a scanner that shows a Google redirect captures nothing useful at all.
What the operators are doing
Most domains follow one template: a keyword, one hyphen, then the bank's name, as in [keyword]-[bank].com. The common keywords are secure, disable, protect and cancel, and less often authorize, terminate, credentials and commercial. KELA's examples include protect-pinnaclefp[.]com (Pinnacle Financial Partners), authorize-valley[.]com (Valley National Bank) and commercial-atfirst[.]com (First Financial Bank). A handful of domains date from late 2025, but most were registered between July and September 2026, peaking in August, often several for the same bank on the same day.
The newer templates aim straight at business banking: help-desk, live-support, treasury-portal and "primary device" names built on the bank's name. About half of the 49 domains that went live in the week to October 25 use them, including help-desk and live-chat look-alikes of JPMorgan, Citi, BMO and Santander, and 53primaryset[.]com, a look-alike of Fifth Third Bank's business banking. In that same week 15 domains came down and the count of impersonated institutions rose from 165 to 183.
Every domain sits behind Cloudflare, which hides the origin server. Brief gaps in that cover exposed a handful of real server addresses, used with two shared-hosting providers in turn. The same backend also runs phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand, which points to one operator or a phishing-as-a-service platform. KELA has not found how victims reach the pages. The keywords suggest bank-alert style messages about a transfer to authorize, a payment to cancel or an account about to be disabled, but that is KELA's inference, not an observed lure. SecurityWeek's summary says more than 200 sites; KELA's own figures are 248 live and more than 300 in total.
What to do
Brand protection and takedown teams. Stop treating a page that says "suspended" as proof of a takedown. Close a case only when the domain no longer resolves (NXDOMAIN) or the registry shows a hold. Run whois or an RDAP lookup and look for clientHold or serverHold in the domain status; a domain with neither, still on Cloudflare with a valid certificate, is still under the operator's control. When you do check the page, use an address the kit has never seen: a phone on mobile data, a residential proxy, or a fresh cloud instance per check, and use a different address for each re-check. VPN and Tor exits are a poor choice given the anonymization blocking. Ask your takedown vendor how it verifies removals, and require the same of it.
Report to Cloudflare as well as the registrar. Cloudflare's abuse form at abuse.cloudflare.com accepts phishing reports; it forwards them to the hosting provider and can put a phishing warning in front of the site. Include the full sign-in URL with its token path if you have it, since the bare domain may serve a decoy.
Find new domains before they go live. The template is regular enough to search for. Query certificate transparency (CT) logs, the public record of every TLS certificate issued, for your bank's name after a hyphen, for example https://crt.sh/?q=%25-yourbank.com, and alert on new hits from a CT stream. Cloudflare's edge certificates are logged like any other, so the proxy does not hide them. dnstwist --registered --dictionary words.txt yourbank.com with the eight keywords plus help-desk, live-support and treasury-portal in words.txt checks which of those names are already registered.
Banks' own telemetry. KELA found Company ID fields on business templates, so a customer report of a strange login page should trigger a check of that company's recent sign-ins: new device, new IP range, a payee added or a limit raised within hours. Force a credential reset and re-enrolment for every user under that Company ID, not only the one who called.
Treasury and finance staff. Open business banking from a saved bookmark or by typing the address, never from a link in an alert, chat or search ad. Ask your bank for passkeys or FIDO2 security keys on treasury accounts. Both are bound to the bank's real domain and will not sign in on a look-alike. One-time codes from an app or a bank-issued token are better than passwords alone, but a live phishing page can relay them. Keep dual approval on new payees and payment releases so one stolen login is not enough to move money.
We monitor look-alike domains and certificate issuance as part of attack surface management, and build detection for suspicious business banking sign-ins in security operations. If you want to know whether your bank's name already has look-alikes on this template, open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: KELA, SecurityWeek, Privacy Needle.