A bank phishing operation tracked by threat intelligence firm KELA shows a fake “account suspended” notice to anyone who checks a site twice, so analysts and takedown providers can close a report while the fake login stays live. The same infrastructure also hosts look-alikes of HSBC, NatWest and HMRC, and KELA’s best lead to the operator is a UK home broadband connection.
What happened
In research dated 3 November 2026, KELA set out a phishing cluster it has named the “Suspended” infrastructure, and SecurityWeek and others reported it on 5 November. KELA has tied more than 300 domains to the operation since May. On 25 October, 248 were live and impersonated 189 US financial institutions, mostly mid-sized regional and commercial lenders rather than household names.
The operation is growing. KELA counted 49 new domains in the week to 25 October against just 15 removals, and the list of targeted institutions grew by 18 in that week alone. Many of the cloned portals are for corporate and treasury users, the accounts that can move large sums by wire.
The US is the main target, but KELA says the same backend serves lures aimed at customers in Britain, the Netherlands, Australia and New Zealand. The UK pages impersonate HSBC, NatWest, HMRC and an unnamed parcel firm. KELA stresses that these brands were impersonated, not breached, and says it briefed law enforcement and affected organisations before going public.
The technical picture
The kit records the IP address of every visitor. A first visit gets a branded login form, with an extra Company ID field on corporate versions and sometimes a reCAPTCHA in front. Any return visit from that address gets a page copying the generic notice a web host displays when it has closed a customer’s account.
That second view is aimed squarely at defenders. A victim normally clicks once. An analyst, a scanner or a brand protection vendor checks a reported site, then goes back to confirm it is gone. The repeat request sees an apparent takedown, the ticket is closed, and the real page carries on harvesting credentials from new arrivals. KELA says newer domains also use other decoys, including a blocking notice, an empty page or a bounce to Google, and some have never been captured by public scanning services.
The browser tab mimics the title of Cloudflare’s challenge screen, and a script tries to stop developer tools opening. Every domain sits behind Cloudflare, which hides where it is hosted. KELA unmasked the origin only because some domains briefly pointed straight at their real servers, visible in historical DNS. These turned out to be a few addresses at two shared hosting firms, used in sequence, each crowded with hundreds of unrelated sites.
Domain names follow a formula: an urgent word such as secure, disable, protect or cancel, a hyphen, then the bank’s name. A newer group uses help desk, live support and treasury themes. How victims are lured is still unknown, though the names read like payment alert subject lines.
Behind the front end KELA mapped a backend server, a second phishing host, a management machine that logs into the hosting control panel, and a jump server, probably running Windows, administering all of them over SSH. That jump server was accessed by Remote Desktop from a UK residential connection on 10 days in mid-October. KELA calls this a lead rather than an identification, as its network data is only a sample and a home line can itself be used as a proxy.
Why it matters for UK organisations
This is not just a US problem. The servers already host lures for two of the largest UK high street banks and for HMRC, a lure that works all year round. If KELA’s lead holds, part of the operation may be run from a British home connection, which could give the NCA and UK police something to act on.
The cloaking also exposes a common weakness in UK phishing response. Banks, retailers, councils and their brand protection suppliers all depend on report, check and close. Many SOCs do the same internally: an analyst opens a reported link in a sandbox, sees a closed-account page and marks the alert benign. This kit is designed to beat exactly that routine. It is not unique either. In August Fortra described “Chameleon SEO Poisoning”, in which fake bank sites looked dead unless the visitor arrived from a poisoned search result.
The focus on corporate banking should worry finance teams too. A stolen treasury login can lead straight to a fraudulent payment that is far harder to claw back than a card transaction.
Expert view
In my experience, the weak point in most phishing response is closure, not detection. Teams are measured on time to resolve, so the confirmation check is rushed and nobody asks whether the “dead” page matches what the victim saw. A closed-account notice on a month-old domain carrying your bank’s name should prompt more digging, not end it.
The research also shows the limits of domain-by-domain takedowns. KELA found that an origin server which hosted look-alikes in early October was still serving a new one on 20 October, even as individual domains were taken down. The shared hosting, backend and management server are where disruption sticks, and that needs registrars, Cloudflare, hosts and police working from the same evidence. When we run phishing simulations, the controls that hold up best are out-of-band payment checks and phishing-resistant MFA, not hoping someone spots the fake in time.
What to do now
- Fix your verification step. Never mark a reported domain as down after one look. Re-test from a fresh IP address that has not visited before, avoid anonymising networks the kit may block, and repeat over several days.
- Treat decoys as signals. On a newly registered look-alike, a closed-account, blocked, empty or redirect response means dig further.
- Hunt the naming pattern. Add rules to newly registered domain monitoring for your brand combined with urgent words such as secure, cancel, help desk or treasury, then confirm by page behaviour before attributing.
- Report along the whole chain. Notify the registrar, Cloudflare and the host where known, and report the site to the NCSC, which can investigate and remove scam websites. Forward suspicious emails to report@phishing.gov.uk, then confirm from a clean address that the page has gone.
- Protect business banking users. Use phishing-resistant MFA where the bank supports it, in line with Cyber Essentials user access control, and require call-back on a known number before authorising or cancelling payments.
- Brief staff. Payment alerts that ask for action via a link should be checked in the bank’s app or by phone. Anyone who has entered details or lost money should call their bank and report to Report Fraud or, in Scotland, Police Scotland.
Bottom line
This campaign needs no zero-day, only defenders who check twice from the same address. The fixes are cheap: better takedown verification, sharper domain monitoring and payment controls that do not rely on spotting a fake. With HSBC, NatWest and HMRC lures on the same servers and a possible operator lead in Britain, UK defenders and police both have reason to act.
Sources
- KELA: Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown
- SecurityWeek: Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
- Privacy Needle: Phishing Kit Uses Fake Suspended Pages to Evade Takedown Efforts
- Help Net Security: Fake bank websites play dead to evade security scanners
- NCSC: Phishing scams: how to spot and report them
