NEW YORK–Cybercriminals operating hundreds of fraudulent financial websites are using fake suspension notices to make security teams believe the sites have already been shut down, ZDNet reported, citing research by cybersecurity firm KELA.
Researchers linked 248 financial scam and phishing domains impersonating 189 major U.S. banks and financial services organizations to shared infrastructure as of Oct. 25, 2026, according to ZDNet. More than 300 scam domains have used the infrastructure since May, and researchers said new ones continued to appear.
KELA calls the operation “Suspended.” Its websites copy legitimate organizations’ sites, with a particular emphasis on business banking. Many domain names combine a bank’s name with words such as “secure,” “disable,” “protect” or “cancel,” ZDNet reported.
Fake Notices Target Repeat Visitors
The operation’s phishing software records visitors’ IP addresses. On a second visit from the same address, it displays a fake “account suspended” page, according to the report. A first-time visitor can still encounter the fraudulent banking site and be prompted to surrender sensitive information, the company said.
It added the approach exploits how security teams investigate suspicious websites: They may visit once to assess a report and return to verify that a takedown has occurred. A false suspension notice on the return visit can suggest the threat has been resolved while the site remains available to new visitors, according to ZDNet.
Researchers also found fake blocked-access notices, blank pages and redirects to Google. Some sites used reCAPTCHA challenges or scripts that interfered with browser developer tools, apparently to hinder analysis, ZDNet reported.
The phishing kit also used a challenge page resembling those legitimately provided by Cloudflare, according to the report.
Shared Servers Support Broader Campaigns
A small group of servers at two shared hosting providers supports the operation, ZDNet reported. Researchers also linked the infrastructure to phishing targeting cryptocurrency exchanges and government services in Britain, the Netherlands, Australia and New Zealand.
KELA researchers said the shared setup could reflect a single operator or a broader phishing-as-a-service platform. The report did not establish which explanation was correct.
Some domains were taken offline after researchers notified law enforcement, but the campaign remained active, according to ZDNet.
Verifying Suspicious Banking Messages
ZDNet advised consumers to watch for unfamiliar sender addresses, misspelled domains, suspicious links and attachments, and messages designed to provoke panic. Consumers seeking to verify a message should contact their financial institution directly using a known phone number rather than one supplied in the message.
KELA also released a free Bank Phishing Check tool that lets organizations compare their names and official domains against the fraudulent websites identified in its research, ZDNet reported.
