MEDIUM Threat Intel #Phishing #Credential Theft #Threat Intelligence

Bank Phishing Campaign Uses Fake Suspended Pages to Evade Takedowns

2026-11-05 15:58 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: Mid-sized regional banks and corporate banking portals face persistent credential harvesting campaigns designed to bypass detection.
Affected systems: More than 300 fake domains impersonating financial institutions across the US, UK, Australia, and New Zealand.
Remediation: Security teams must cycle IP addresses during domain verification and monitor for look-alike registration patterns.

A sophisticated phishing operation targeting financial institutions has been deploying deceptive tactics to evade detection and frustrate takedown efforts. According to SecurityWeek, threat actors have relied on more than 300 fake domains since May, primarily focusing on mid-sized regional banks, as well as major financial entities in the US, UK, Australia, and New Zealand.

Technical Analysis of the ‘Suspended’ Phishing Infrastructure

The campaign leverages a distinct functional kit designed to deceive automated security tools, threat intelligence researchers, and incident response personnel. The infrastructure tracks visitor IP addresses to control the content served during each interaction.

Evasion Mechanics

First-Time Visitors: Initial visits from a unique IP address deliver a convincing credential harvesting portal featuring official bank branding, request fields for user IDs and passwords, and simulated reCAPTCHA challenges. Some pages copy Cloudflare challenge titles or deploy scripts that block browser developer tools.
Repeat Visitors: Any subsequent visit from the same IP address immediately serves a fake hosting account suspension notice. This mimics standard notifications used by legitimate hosting providers when an account is closed.

This IP-locking mechanism effectively blinds security teams and takedown providers. Because automated scanners and incident verifiers frequently check reported URLs multiple times to confirm remediation, the secondary check returns an inactive status. Consequently, security analysts mark the domain as offline while it continues to serve malicious content to unsuspecting first-time victims.

Domain Naming Conventions and Targeting

Phishing operators use systematic naming templates to generate look-alike domains. Most URLs incorporate keywords such as ‘secure’, ‘disable’, ‘protect’, ‘cancel’, ‘authorize’, ‘terminate’, ‘credentials’, and ‘commercial’, paired with a hyphenated target bank name. A newer subset utilizes help-desk, live-support, and treasury-portal templates mimicking institutions like JPMorgan, Citi, BMO, and Santander.

Evidence gathered by researchers indicates that the campaign heavily targets business banking and treasury portals rather than standard consumer accounts, elevating the potential financial impact for compromised organizations.

Actionable Mitigations

Defenders and security operations teams must adapt their detection and takedown validation workflows to counter IP-filtering evasion tactics.

Dynamic IP Verification: When investigating or verifying reported phishing domains, incident responders must rotate IP addresses or utilize distributed vantage points to ensure the server is not serving localized evasion screens.
Proactive Domain Monitoring: Monitor certificate transparency logs and domain registration activity for naming conventions combining security-related keywords with brand identifiers.
Infrastructure Blocking: Implement threat intelligence feeds to block associated shared hosting nodes and edge proxy configurations utilized by the threat actors behind this infrastructure.

#Phishing #Credential Theft #Threat Intelligence #Financial Fraud

X/Twitter LinkedIn Reddit HN

← Back to Articles