Cybersecurity researchers have uncovered a financial phishing operation that displays fraudulent suspension notices to security scanners while showing victims fully functional fake banking websites. As of October 25, 2026, 248 fraudulent financial scam and phishing domains connected to 189 major US banks and financial services were tied to the same infrastructure, according to a report published Tuesday by KELA. The scheme, which the firm calls the "Suspended" infrastructure operation, has hosted over 300 scam domains on the same infrastructure since May this year, with new fraudulent domains appearing daily.
The phishing scheme works by tracking visitor IP addresses through an embedded kit disguised as a Cloudflare challenge page. On a victim's first visit, they see a cloned website of a legitimate bank, complete with prompts to enter personal information. On the second visit to the same domain, the system automatically displays a fake "account suspended" page. The fraudulent domains predominantly target business banking and follow a [keyword]-[bank].com naming pattern, inserting terms like "secure," "disable," "protect," and "cancel." Researchers also identified other decoy tactics, including fake "Sorry, you've been blocked" messages, blank pages, redirections to Google, reCAPTCHAs, and scripts that block browser developer tools to hinder analysis.
The false suspension notices are designed to fool the very people tasked with shutting down malicious sites, KELA says. "That design targets exactly the people who could shut a site down," the report states. "A victim typically follows a link once. A scanner, a security team or a takedown provider checks a reported site and then checks it again to confirm, and the second check shows what looks like a completed takedown." According to the researchers, this creates an illusion that law enforcement or technology firms have already seized the infrastructure, prompting security teams to move on to the next suspicious website rather than investigate further. The campaign remains active as of this writing, and one potential lead points to an operator connecting remotely to the malicious infrastructure through a standard UK home broadband connection, though this hasn't been verified.
The scheme exploits how website takedowns normally work. When law enforcement agencies and technology firms discover malicious domains, they obtain court orders and force suspensions through registrars or hosting providers, which then display takedown notices. Scanners and security professionals see these notices and move on, assuming the threat has been neutralized. By generating their own fake suspension messages, the scammers hijack this trust mechanism, ensuring their phishing sites stay online longer and collect more victims. The campaign particularly focuses on business banking, where credential theft can lead to larger financial losses and identity theft. KELA has released a free Bank Phishing Check tool that allows organizations to compare official domains against the fraudulent websites identified in the research. Individuals should verify suspicious links through phishing checkers and watch for telltale signs including unusual email addresses, poor formatting, emotionally manipulative content demanding immediate payment or threatening legal action, and suspicious links or attachments.
The report warns that the infrastructure continues to expand, with fresh domains launching every day despite ongoing law enforcement disclosure. Organizations should use domain verification tools and educate staff to recognize phishing indicators, while individuals who receive urgent banking messages should contact their financial institutions directly using phone numbers from official sources, not from emails. The bottom line: a suspended website isn't necessarily dead, and a second look from security teams may reveal nothing has been suspended at all. The deliberate exploitation of takedown procedures reveals a troubling shift in adversary sophistication, one that turns defensive infrastructure into an unwitting accomplice. Financial institutions may need to rethink how they validate threat intelligence when the indicators of compromise can themselves be weaponized.