{"id":4008,"date":"2026-11-06T09:29:09","date_gmt":"2026-11-06T17:29:09","guid":{"rendered":"https:\/\/cyber.mag212.com\/kela-bank-phishing-kit-fakes-takedown-189-us-banks\/"},"modified":"2026-11-06T09:29:09","modified_gmt":"2026-11-06T17:29:09","slug":"kela-bank-phishing-kit-fakes-takedown-189-us-banks","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/kela-bank-phishing-kit-fakes-takedown-189-us-banks\/","title":{"rendered":"Bank Phishing Kit Fakes Its Own Takedown: KELA Tracks 248 Live Domains Impersonating 189 US Banks"},"content":{"rendered":"\n

MAG212 CYBER | Threat Intelligence | November 6, 2026<\/strong><\/p>\n\n\n\n

Threat intelligence firm KELA<\/strong> has documented a phishing network that impersonates US banks and hides behind its own fake takedown notice. As of 25 October 2026<\/strong>, KELA counted 248 live phishing domains impersonating 189 US financial institutions<\/strong>, 183 of which still had live look-alikes that day. First-time visitors see a convincing bank login. Anyone returning from the same IP address, such as an analyst checking a report, gets a page claiming the hosting account was suspended. The site looks dead but is still collecting credentials.<\/p>\n\n\n\n

Key facts<\/h2>\n\n\n\n
Item<\/th>Detail<\/th><\/tr><\/thead>
Researcher<\/strong><\/td>KELA Cyber Intelligence Center, report updated 3 November 2026<\/td><\/tr>
Live scale (25 Oct)<\/strong><\/td>248 live domains impersonating 189 US financial institutions; 183 with live look-alikes that day<\/td><\/tr>
Total since May<\/strong><\/td>More than 300 domains, including ones now offline<\/td><\/tr>
Targets<\/strong><\/td>Mostly mid-sized regional and commercial banks and lenders, plus a few large national banks<\/td><\/tr>
Data stolen<\/strong><\/td>User ID and password; business versions add a Company ID field<\/td><\/tr>
Evasion<\/strong><\/td>Repeat visits from the same IP see a fake “account suspended” page or other decoys<\/td><\/tr>
Operator lead<\/strong><\/td>A UK residential broadband connection, which KELA calls “a lead rather than an identification”<\/td><\/tr>
Victims<\/strong><\/td>Unknown; the banks were impersonated, not breached<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

A note on the numbers.<\/strong> Some coverage, including BankInfoSecurity’s headline, refers to “300 US banks”. That figure is KELA’s count of domains<\/strong> seen since May 2026, not banks.<\/p>\n\n\n\n

How the fake takedown works<\/h2>\n\n\n\n

KELA’s report opens with a line every analyst will recognise: “Every analyst knows the ‘suspended’ page.” The campaign turns that familiarity against defenders:<\/p>\n\n\n\n

    \n
  1. First visit.<\/strong> A visitor arriving from a new IP address sees the phishing page, a copy of the bank’s login with its logos, imagery, FDIC insurance banner and footer links. The browser tab reads “Attention required”, copying Cloudflare’s challenge page.<\/li>\n\n\n\n
  2. Gates.<\/strong> Some deployments show a reCAPTCHA first. Pages include a script that blocks browser developer tools. The sign-in path carries a long tokenized session ID, and some deployments use \/auth\/login.php<\/code>.<\/li>\n\n\n\n
  3. Harvest.<\/strong> The victim enters a User ID and password. Business-banking versions also ask for a Company ID. The form posts the data to a script on the same domain.<\/li>\n\n\n\n
  4. Repeat visit.<\/strong> If the same IP comes back, the kit shows a fake “This account has been suspended” page made to look like a hosting provider’s closure notice, complete with a “Contact your hosting provider” link.<\/li>\n\n\n\n
  5. Other decoys.<\/strong> Instead of the suspended page, repeat visitors may get a “Sorry, you have been blocked” notice, a blank page or a redirect to Google. Some newer domains also block traffic from anonymization networks.<\/li>\n<\/ol>\n\n\n\n

    A scanner or takedown team re-checking a reported URL sees a dead site while new victims still reach the login. Any workflow that re-checks from the same address will mark live phishing as gone.<\/p>\n\n\n\n

    Domain patterns<\/h2>\n\n\n\n

    KELA describes a main naming formula of [urgency keyword]-[bank name].com<\/code>. Common keywords are secure, disable, protect<\/strong> and cancel<\/strong>. Less common ones are authorize, terminate, credentials<\/strong> and commercial<\/strong>. Business-banking templates use themes such as help-desk, live-support, treasury-portal<\/strong> and “primary device”<\/strong>.<\/p>\n\n\n\n

    Examples published by KELA (defanged):<\/p>\n\n\n\n

    Domain<\/th>Brand impersonated<\/th><\/tr><\/thead>
    protect-pinnaclefp[.]com<\/td>Pinnacle Financial Partners<\/td><\/tr>
    authorize-valley[.]com<\/td>Valley National Bank<\/td><\/tr>
    commercial-atfirst[.]com<\/td>First Financial Bank<\/td><\/tr>
    53primaryset[.]com<\/td>Fifth Third Bank (business banking)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Many pages are business banking or treasury logins, which KELA notes can send wires and ACH transfers. In our assessment, the Company ID field and the treasury focus point to wire and ACH fraud rather than ordinary retail account theft.<\/p>\n\n\n\n

    Growth and infrastructure<\/h2>\n\n\n\n

    The campaign is growing. On 17 October there were 214 live domains. In the week to 25 October, 49 new domains went live (about half using business-banking templates) and 15 were taken down, while targeted institutions rose from 165 to 183. Earliest activity dates to mid-May 2026, domain registrations peaked in August, and the hosting moved in September.<\/p>\n\n\n\n

    Every domain sits behind Cloudflare<\/strong>, which issues the certificates and hides the origin servers. Brief gaps in DNS protection exposed those origins in historical DNS data. KELA does not name the hosting providers.<\/p>\n\n\n\n