Bank phishing cloaks active domains with fake suspension pages

At a glance

What this is: NHI Mgmt Group's analysis, drawing on KELA's report: A bank-phishing cluster uses visitor-based cloaking to make active look-alike domains appear suspended after repeat checks.

Why it matters: This matters because takedown, brand-protection and fraud teams can misread a live phishing page as closed, allowing credential capture to continue while monitoring looks clean.

By the numbers:

• KELA identified 248 live phishing domains impersonating 189 US financial institutions as of October 25, 2026.
• KELA had identified more than 300 domains in the same infrastructure since May 2026.

Context

A phishing campaign can stay active even after a takedown request if the site shows different content to scanners and to new victims. In this case, the core governance gap is visitor verification, because defenders often rely on repeat checks from the same source and treat a “suspended” response as proof that the threat is gone.

Look-alike bank domains are especially effective when the lure, the login page and the decoy response all support one deception chain. That matters for brand-protection, fraud response and identity teams because the same infrastructure can keep harvesting credentials while presenting a false closure state to investigators.

Key questions

Q: What should teams do first when a bank phishing domain is reported?

A: First, preserve the reported domain, IP address, headers, page source and screenshots, then check whether the site serves a phishing page only to selected visitors and from which hosting point it is delivered, including any fresh IP address. That evidence helps confirm jurisdiction, hosting provider and abuse report details before takedown requests are sent.

Q: Why do fake suspension pages let phishing campaigns evade takedown?

A: Fake suspension pages make phishing campaigns harder to remove because they show a benign page to scanners, providers and abuse teams while showing the phishing content to real victims. That cloaking weakens simple URL checks, so analysts must test from different user agents, geographies and IP ranges before assuming a takedown has succeeded.

Q: How do cloaked phishing kits change what analysts should look for?

A: Cloaked phishing kits mean analysts should inspect more than the visible page, including server-side redirects, response differences by user agent, referrer and IP reputation, and any hidden scripts or filters. The key failure mode is relying on one fetch path, which can miss the malicious content served to real targets.

Q: What is the best way to validate a phishing takedown?

A: The best way to validate a phishing takedown is to recheck the URL from multiple networks and user agents, confirm the host no longer serves the malicious content, and verify that redirects, DNS, SSL certificate and web page responses now point to a sinkhole, block page or removal notice. Keep time-stamped evidence for escalation.

Technical breakdown

How visitor-based cloaking changes phishing detection

Visitor-based cloaking uses request state, usually the source IP address, to decide which content to serve. A first-time visitor sees the phishing page, while a returning visitor gets a decoy, often a suspension notice, blank page or redirect. That breaks simple verification workflows because scanners and takedown teams often revisit from the same network path. The domain can therefore look inactive without actually being removed. In bank-phishing operations, this technique is useful because it preserves the live lure while making the evidence path appear resolved to anyone who checks twice from the same address. See the Phishing Guide.

Practical implication: Verify suspicious domains from fresh addresses and avoid treating a second fetch as proof of takedown.

Why shared hosting and proxy layers slow containment

Phishing operators often place many look-alike domains behind a proxy layer and on shared hosting so the visible domain can change faster than the underlying infrastructure. When one domain is reported, the origin server and backend may continue to host other lures or be re-used for the next wave. Cloud proxy services also hide the origin, which means defenders may see only the front door unless historical DNS or telemetry reveals the backend. That makes removal a coordinated task across registrar, proxy provider and hosting layer rather than a single blocklist action. See the Brand Impersonation and Lookalike Domain Takedown Playbook.

Practical implication: Trace the origin and backend before declaring the campaign contained, then coordinate with every infrastructure layer.

How banking phishing kits use session memory to defeat inspection

This campaign records whether a visitor has already reached the site, then alters the response on subsequent visits. That simple session memory is enough to distinguish a likely victim from a checker. The result is a split experience: normal users see the login flow, while analysts see a “closed” page that looks like a completed takedown. The same pattern can also include reCAPTCHA, developer-tools blocking and tokenised URLs, all of which increase friction for inspection without stopping the theft path.

Practical implication: Assume the kit is stateful and test from clean sessions, different IPs and repeated intervals.

Threat narrative

Attacker objective: The objective is to capture banking credentials and business portal access while keeping the phishing infrastructure looking inactive to defenders.

1. Entry occurs when victims are directed to look-alike bank domains through messages that match cancellation, authorisation or account-disabling themes.
2. Credential harvesting happens when first-time visitors see a branded login form and submit user IDs, passwords and, in business templates, company identifiers.
3. Escalation is avoided by the operators through cloaking, because repeat visitors and many scanners are shown a fake suspension page instead of the live lure.
4. Impact is credential capture from bank and treasury portals, with higher value at the business-account end of the campaign.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Visitor-state cloaking turns takedown validation into a trust problem. The operational weakness is not the lack of a blocklist, but the assumption that a second check from the same source proves removal. In this campaign, the server remembers the visitor and serves different content accordingly, which means verification has to be designed as an adversarial test. Banks and defenders should treat takedown confirmation as a separate control, not an administrative afterthought.

The campaign shows how brand impersonation and infrastructure cloaking reinforce each other. The lure names, the login template and the suspension decoy work as one chain, which is why the domain itself can be only half the story. That is why look-alike domain response and identity fraud response belong together in the same operating model, including social engineering controls where the lure path begins. Practitioners should align fraud, brand and security workflows around the same evidence standard.

Business banking phishing raises the cost of false negatives. When the target is treasury or commercial banking, the credential set can be more valuable and the downstream fraud path more damaging than a retail login theft. The named concept here is suspension masquerade: a decoy closure page that makes a live phishing domain appear remediated to repeat visitors. That concept should change how security teams score closure evidence and how quickly they declare a lure inactive.

Shared backend reuse shows that domain takedown is not the same as infrastructure containment. The same server stack can continue serving other lures after one domain is removed, so a narrow takedown can leave the operator's capability intact. This is the kind of campaign where defenders should think in terms of operator infrastructure, not individual domain tickets. The practical conclusion is that removal, attribution and monitoring have to be coupled.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Suspension masquerade: active phishing infrastructure can present a closure screen to repeat visitors, which means takedown operations need a verification model that assumes the page is adversarial. Brand-protection teams should expect the attacker to optimise for the investigator's workflow, not just the victim's click path.

Bank phishing response is shifting from simple domain removal to evidence handling across registrar, proxy and hosting layers. That raises the value of fresh-source validation, because a live lure can stay operational while every standard check suggests the opposite.

For practitioners

• Inspect suspicious bank domains from fresh sources Use clean IPs and separate browser sessions when validating a reported phishing domain, because repeat visits can trigger the decoy suspension page. See the Phishing Guide.
• Correlate domain naming patterns with lure priority Flag newly registered .com domains that combine urgency words such as secure, disable, protect, cancel, authorize or terminate with a bank name or customer name.
• Treat takedown confirmation as a multi-step check Verify that the origin page is gone, not just that a proxy page or suspension notice appeared, and recheck over several days from different networks.
• Warn business banking users about transfer lures Tell customers to confirm any request to cancel or authorise a payment through a known bank channel, not through a link embedded in a message.

Key takeaways

• The campaign succeeds by making active phishing infrastructure look closed to repeat visitors and scanners.
• KELA documented 248 live look-alike domains impersonating 189 US financial institutions as of October 25, 2026.
• Defenders need fresh-source validation and repeated checks before declaring a look-alike bank domain removed.

Related NHI Mgmt Group resources: Phishing Guide · Social Engineering Guide · Brand Impersonation and Lookalike Domain Takedown Playbook · Mailchimp breach 2022

Key terms

• Phishing Kit: A phishing kit is a packaged set of tools that helps an attacker create and run deceptive email campaigns with minimal technical effort. Modern kits often automate message generation, sender manipulation, and delivery testing, which makes abuse faster to launch and harder to distinguish from legitimate messaging at scale.
• Takedown Verification: Takedown Verification is the process of confirming that a reported malicious site, domain or hosting endpoint has actually been removed or disabled. It usually includes repeat checks from different networks, inspection of HTTP responses and redirects, and evidence that the original phishing content is no longer reachable.
• Look-Alike Domains: Look-alike domains are website names that closely resemble a trusted brand or internal domain, using misspellings, added characters, or alternate endings to deceive users and systems. In identity security, they are used for phishing, credential theft, and impersonation, so organizations monitor registrations and block risky domain patterns.
• Brand Impersonation: Brand impersonation is the use of a company’s name, logo, or identity cues to deceive people into trusting a fake message, site, account, or service. In security terms, it is a social engineering and fraud tactic that exploits trusted brand signals to steal credentials, secrets, payments, or access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and secrets management. It helps security and identity practitioners connect identity controls to the wider threat paths their programmes face.