Hunt: KELA's 'Suspended' bank-phishing kit shows a real login on first visit and a fake hosting-suspension page on every return, so takedown teams think the site is already dead
- Naming tells: domains built from keywords such as secure, disable, protect, cancel, authorize, terminate, credentials or commercial plus a hyphen and the bank name; a growing set uses help-desk, live-support, treasury-portal and "primary device" templates (including look-alikes of JPMorgan, Citi, BMO and Santander).
- Hunt / takedown: do not trust a second check from the same IP or the same cloud egress. Re-check reported bank look-alikes from a fresh IP (or residential + datacenter) every time; screenshot OCR/runtime browser analysis beats static HTML; watch for pages that block DevTools and mirror Cloudflare challenge titles.
- Audience: KELA assesses the lure set targets business banking and treasury logins more than retail consumers. Warn treasury and AP staff; feed the naming patterns into brand-protection and DNS watchlists.
Sources: KELA: Not Actually Suspended — How a Bank-Phishing Network Fakes Its Own Takedown (Nov 3) · SecurityWeek: Bank Phishing Sites Show Fake 'Suspended' Pages to Evade Takedowns (Nov 5)