Topic starter
11/11/2026 6:00 pm
TL;DR: 248 live look-alike domains show how KELA’s data set captures a bank phishing network that cloaks active pages behind a fake “account suspended” response for repeat visitors. Domain takedown workflows now need independent verification from fresh addresses, or active phishing can look closed.
Editorial analysis by NHI Mgmt Group, based on content published by KELA: “Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown”.
By the numbers:
- KELA identified 248 live phishing domains impersonating 189 US financial institutions as of October 25, 2026.
- KELA had identified more than 300 domains in the same infrastructure since May 2026.
Key questions
Q: Why do fake suspension pages let phishing campaigns evade takedown?
A: Fake suspension pages make phishing campaigns harder to remove because they show a benign page to scanners, providers and abuse teams while showing the phishing content to real victims.
Q: How do cloaked phishing kits change what analysts should look for?
A: Cloaked phishing kits mean analysts should inspect more than the visible page, including server-side redirects, response differences by user agent, referrer and IP reputation, and any hidden scripts or filters.
Q: What should teams do first when a bank phishing domain is reported?
A: First, preserve the reported domain, IP address, headers, page source and screenshots, then check whether the site serves a phishing page only to selected visitors and from which hosting point it is delivered, including any fresh IP address.
Practitioner guidance
- Inspect suspicious bank domains from fresh sources Use clean IPs and separate browser sessions when validating a reported phishing domain, because repeat visits can trigger the decoy suspension page.
- Correlate domain naming patterns with lure priority Flag newly registered .com domains that combine urgency words such as secure, disable, protect, cancel, authorize or terminate with a bank name or customer name.
- Treat takedown confirmation as a multi-step check Verify that the origin page is gone, not just that a proxy page or suspension notice appeared, and recheck over several days from different networks.
Bottom line: The campaign succeeds by making active phishing infrastructure look closed to repeat visitors and scanners.
Glossary terms: Phishing Kit, Takedown Verification, Look-Alike Domains, Brand Impersonation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Visitor-state cloaking turns takedown validation into a trust problem. The operational weakness is not the lack of a blocklist, but the assumption that a second check from the same source proves removal. In this campaign, the server remembers the visitor and serves different content accordingly, which means verification has to be designed as an adversarial test. Banks and defenders should treat takedown confirmation as a separate control, not an administrative afterthought.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What is the best way to validate a phishing takedown?
A: The best way to validate a phishing takedown is to recheck the URL from multiple networks and user agents, confirm the host no longer serves the malicious content, and verify that redirects, DNS, SSL certificate and web page responses now point to a sinkhole, block page or removal notice. Keep time-stamped evidence for escalation.
👉 Read our full editorial: Bank phishing cloaks active domains with fake suspension pages