Bank Phishing Kit Fakes Its Own Takedown: KELA Tracks 248 Live Domains Impersonating 189 US Banks
MAG212 CYBER | Threat Intelligence | November 6, 2026
Threat intelligence firm KELA has documented a phishing network that impersonates US banks and hides behind its own fake takedown notice. As of 25 October 2026, KELA counted 248 live phishing domains impersonating 189 US financial institutions, 183 of which still had live look-alikes that day. First-time visitors see a convincing bank login. Anyone returning from the same IP address, such as an analyst checking a report, gets a page claiming the hosting account was suspended. The site looks dead but is still collecting credentials.
Key facts
| Item | Detail |
|---|---|
| Researcher | KELA Cyber Intelligence Center, report updated 3 November 2026 |
| Live scale (25 Oct) | 248 live domains impersonating 189 US financial institutions; 183 with live look-alikes that day |
| Total since May | More than 300 domains, including ones now offline |
| Targets | Mostly mid-sized regional and commercial banks and lenders, plus a few large national banks |
| Data stolen | User ID and password; business versions add a Company ID field |
| Evasion | Repeat visits from the same IP see a fake “account suspended” page or other decoys |
| Operator lead | A UK residential broadband connection, which KELA calls “a lead rather than an identification” |
| Victims | Unknown; the banks were impersonated, not breached |
A note on the numbers. Some coverage, including BankInfoSecurity’s headline, refers to “300 US banks”. That figure is KELA’s count of domains seen since May 2026, not banks.
How the fake takedown works
KELA’s report opens with a line every analyst will recognise: “Every analyst knows the ‘suspended’ page.” The campaign turns that familiarity against defenders:
- First visit. A visitor arriving from a new IP address sees the phishing page, a copy of the bank’s login with its logos, imagery, FDIC insurance banner and footer links. The browser tab reads “Attention required”, copying Cloudflare’s challenge page.
- Gates. Some deployments show a reCAPTCHA first. Pages include a script that blocks browser developer tools. The sign-in path carries a long tokenized session ID, and some deployments use
/auth/login.php. - Harvest. The victim enters a User ID and password. Business-banking versions also ask for a Company ID. The form posts the data to a script on the same domain.
- Repeat visit. If the same IP comes back, the kit shows a fake “This account has been suspended” page made to look like a hosting provider’s closure notice, complete with a “Contact your hosting provider” link.
- Other decoys. Instead of the suspended page, repeat visitors may get a “Sorry, you have been blocked” notice, a blank page or a redirect to Google. Some newer domains also block traffic from anonymization networks.
A scanner or takedown team re-checking a reported URL sees a dead site while new victims still reach the login. Any workflow that re-checks from the same address will mark live phishing as gone.
Domain patterns
KELA describes a main naming formula of [urgency keyword]-[bank name].com. Common keywords are secure, disable, protect and cancel. Less common ones are authorize, terminate, credentials and commercial. Business-banking templates use themes such as help-desk, live-support, treasury-portal and “primary device”.
Examples published by KELA (defanged):
| Domain | Brand impersonated |
|---|---|
| protect-pinnaclefp[.]com | Pinnacle Financial Partners |
| authorize-valley[.]com | Valley National Bank |
| commercial-atfirst[.]com | First Financial Bank |
| 53primaryset[.]com | Fifth Third Bank (business banking) |
Many pages are business banking or treasury logins, which KELA notes can send wires and ACH transfers. In our assessment, the Company ID field and the treasury focus point to wire and ACH fraud rather than ordinary retail account theft.
Growth and infrastructure
The campaign is growing. On 17 October there were 214 live domains. In the week to 25 October, 49 new domains went live (about half using business-banking templates) and 15 were taken down, while targeted institutions rose from 165 to 183. Earliest activity dates to mid-May 2026, domain registrations peaked in August, and the hosting moved in September.
Every domain sits behind Cloudflare, which issues the certificates and hides the origin servers. Brief gaps in DNS protection exposed those origins in historical DNS data. KELA does not name the hosting providers.
- Origins: shared hosting at a first provider from May to August 2026, then a shared cPanel server at a second provider, where each origin IP is shared with hundreds of unrelated sites.
- Backend and front end: a cloud backend, connected to the US-bank origin from 10 October, manages a cloud-VM front end over SSH; the front end polls the origin over HTTP.
- “Bot” server: set up on 9 October, it logs into the origin’s WHM panel, with sessions through 26 October.
- Jump server: probably Windows, reached over Remote Desktop and used to SSH into the other hosts.
All of these servers were still active on 26 October. KELA has not found the kit advertised in the underground sources it monitors.
The same infrastructure also hosts mostly retail-focused lures for brands including HSBC, NatWest, HMRC, ABN AMRO, Bitvavo, CoinSpot, Australia Post and New Zealand’s ASB Bank. KELA says this suggests either one operator running several campaigns or a phishing-as-a-service platform. According to BankInfoSecurity, researchers cannot confirm a single operator because the non-US lures use different naming and target consumer brands.
The UK lead
KELA reports that the jump server was reached over Remote Desktop from a residential broadband connection in the UK on 10 days between 11 and 20 October, and the same connection reached the backend directly. IP-reputation services list it as an ordinary home connection, not a VPN, proxy or hosting address.
A separate web panel was visited in short bursts, mostly between 05:00 and 07:00 UTC, through Mullvad VPN, Tor and the same UK connection. The jump server also talks to Telegram data centres, though KELA cannot tell whether a person or an automated client is behind that.
KELA is careful here. It calls the UK connection “a lead rather than an identification”, because a home connection can be used as a proxy by others. BankInfoSecurity reports that researchers described it as no smoking gun. KELA says it shared its findings with law enforcement, intelligence agencies and affected organizations before publishing.
What banks and security teams should do
KELA recommends:
- Watch new registrations. Monitor newly registered .com domains that combine the urgency keywords with your institution’s name, plus the help-desk, live-support, treasury and “primary device” themes. Confirm by page behaviour before attributing a domain to this campaign.
- Never clear a domain after one visit. Re-check from new IP addresses, avoid anonymization networks (some domains block them) and repeat the check over several days. A “suspended” page is not proof of takedown.
- Confirm takedowns end to end. Report to the registrar, Cloudflare and the hosting provider, then verify from a fresh IP that the page is really gone.
- Avoid broad IP blocks. The origin IPs are shared with hundreds of unrelated sites, so blocking them causes collateral damage.
- Use KELA’s lookup. KELA launched a free “Bank Phishing Check” tool alongside the report, which shows whether a bank’s name or domain is on its list as of 25 October. Listed institutions can contact KELA for specific domains and infrastructure addresses.
Advice for business-banking users
KELA warns that messages asking customers to cancel or authorize a transfer via a link match this campaign’s themes. For finance and treasury staff:
- Don’t sign in to business banking from a link in an email or text. Use a saved bookmark or the bank’s app.
- If a message says a payment, device or account needs urgent action, call the bank on a number you already know, not one in the message.
- Use dual approval for wires and ACH batches so one stolen login cannot move money alone.
Frequently asked questions
How many banks are targeted?
189 US financial institutions were impersonated by 248 live domains on 25 October 2026. The “300” in some headlines counts domains, not banks.
Were the banks breached?
No. They were impersonated, not breached. The risk is to customers’ credentials. Victim numbers are unknown.
Why does the phishing site look offline when I check it?
The kit shows the login only on a first visit from an IP address; repeat visits get decoys. Re-check from a fresh IP before concluding it is down.
Has the operator been identified?
No. KELA traced Remote Desktop access to a UK residential connection but calls it “a lead rather than an identification”, since a home connection can be used by others.
Sources
- KELA: Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown
- BankInfoSecurity: Phishing campaign actively targets customers of US banks (3 Nov 2026)
This article expands a story from the MAG212 CYBER Daily, 6 November 2026.