THE CRUNCH
A phishing campaign targeting banks has been hiding its fake login pages behind a simple trick: the sites remember each visitor’s IP address. First-time visitors get a bank-branded login page, while anyone returning, including security teams verifying a takedown, sees what looks like a closed hosting account, according to cybersecurity firm Kela. The firm has dubbed the cluster the ‘Suspended’ infrastructure. It has tracked more than 300 fake domains active since May, including 248 impersonating 189 US financial institutions, mostly mid-sized regional banks. Most domains appeared between July and September 2026, and as of October 25, 183 targeted organisations still had live look-alikes. Forty-nine new domains went live in the week to October 25.
The domains follow recognisable naming patterns, pairing keywords such as ‘secure’, ‘cancel’ or ‘credentials’ with the targeted bank’s name. A smaller, growing group uses help-desk and live-support style names; about half of the 49 newest domains use these templates, including help-desk and live-chat look-alikes of JPMorgan, Citi, BMO and Santander.
The pages themselves ask for a user ID and password, may show a reCAPTCHA, and copy Cloudflare’s ‘Attention required’ tab title while a script blocks browser developer tools. Kela concluded the campaign is largely after business banking and treasury logins rather than personal accounts, though it has not established how victims are lured in. Some domains also briefly resolved to their real servers, revealing hosting that also serves targets in the UK, Australia and New Zealand.
The IP-based cloaking has a practical consequence for defenders: a takedown provider can check a reported site, see the fake suspension notice, and mark the domain as down while it is still serving phishing pages to new visitors. Kela notes that confirming live content requires a fresh IP address for every check, and that shared servers let the operation outlast any single domain.