Phishing Kit Uses Fake Suspended Pages to Evade Takedown Efforts

A sophisticated phishing campaign is using fake “suspended account” notices to hide malicious banking login pages from security researchers and takedown providers.

Cybersecurity firm Kela has identified a cluster of phishing infrastructure that employs IP-based evasion to deceive those attempting to investigate or shut down fraudulent domains. The campaign, which has been active since May, utilises a kit that tracks every visitor’s IP address to serve different content based on whether the user is a first-time visitor or a returning one.

When a new visitor accesses one of the fraudulent sites, they are presented with a legitimate-looking bank login page designed to harvest credentials. However, any subsequent visit from the same IP address results in a fake “account suspended” page. This page mimics the notice typically shown by hosting providers when an account has been closed, effectively tricking security teams and automated scanners into believing the site has already been taken down.

The campaign appears to specifically target business banking and treasury logins rather than individual personal accounts. Kela’s research indicates that more than 300 fake domains have been used in the campaign, with 248 of them impersonating 189 different US financial institutions, primarily targeting mid-sized regional banks.

Evasion and Branding Tactics

The fraudulent domains often follow specific naming patterns to build trust or urgency. Attackers have used keywords such as “secure”, “disable”, “protect”, “cancel”, “authorize”, “terminate”, and “credentials” followed by the name of the targeted bank. A growing subset of the infrastructure uses terms like “help-desk”, “live-support”, and “treasury-portal”.

To further enhance the deception, the phishing pages often use branding from the targeted institution and may include a reCAPTCHA to mimic legitimate security checks. The pages also attempt to block browser developer tools to hinder technical analysis. Some sites even adopt tab titles like “Attention required” to mirror Cloudflare’s challenge pages.

The infrastructure is notably difficult to disrupt for several reasons. Many of the sites sit behind Cloudflare, which masks the actual hosting location. Additionally, the use of the “suspended” notice specifically targets the very people—such as security teams and takedown providers—who are most likely to visit a reported site multiple times to confirm its status. In practice, a provider may mark a domain as inactive while it continues to serve phishing content to new visitors.

While the campaign has a heavy presence in the United States, traces of the activity suggest it also impacts victims in the United Kingdom, Australia, and New Zealand.