---
title: Hunt: KELA's 'Suspended' bank-phishing kit shows a real login on first visit and a fake hosting-suspension page on every return, so takedown teams think the site is already dead | ctxsec
url: https://ctxsec.com/items/hunt-kela-bank-phishing-suspended-fake-takedown-ip-remember
description: "KELA tracked a bank-phishing cluster active since May 2026 that remembers each visitor IP. The first hit gets a branded business-banking / treasury login (sometimes with reCAPTCHA and a Cloudflare-style \"Attention required\" tab title); any revisit from the same IP gets a \"This account has been suspended\" page that looks like a closed hosting account. That design fools scanners and takedown providers who check a reported URL twice. KELA saw 300+ look-alike domains (248 impersonating 189 U.S. financial institutions); as of Oct 25, 183 targets still had live look-alikes, mostly mid-sized regional banks, and 49 new domains appeared in the week to Oct 25."
status: "confirmed research (KELA, Nov 3; SecurityWeek coverage Nov 5)"
published: 2026-11-05
---

> KELA tracked a bank-phishing cluster active since May 2026 that remembers each visitor IP. The first hit gets a branded business-banking / treasury login (sometimes with reCAPTCHA and a Cloudflare-style "Attention required" tab title); any revisit from the same IP gets a "This account has been suspended" page that looks like a closed hosting account. That design fools scanners and takedown providers who check a reported URL twice. KELA saw 300+ look-alike domains (248 impersonating 189 U.S. financial institutions); as of Oct 25, 183 targets still had live look-alikes, mostly mid-sized regional banks, and 49 new domains appeared in the week to Oct 25.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-kela-bank-phishing-suspended-fake-takedown-ip-remember.md)

confirmed research (KELA, Nov 3; SecurityWeek coverage Nov 5)

2026-11-05

### Hunt: KELA's 'Suspended' bank-phishing kit shows a real login on first visit and a fake hosting-suspension page on every return, so takedown teams think the site is already dead

- **Naming tells:** domains built from keywords such as secure, disable, protect, cancel, authorize, terminate, credentials or commercial plus a hyphen and the bank name; a growing set uses help-desk, live-support, treasury-portal and "primary device" templates (including look-alikes of JPMorgan, Citi, BMO and Santander).
- **Hunt / takedown:** do not trust a second check from the same IP or the same cloud egress. Re-check reported bank look-alikes from a fresh IP (or residential + datacenter) every time; screenshot OCR/runtime browser analysis beats static HTML; watch for pages that block DevTools and mirror Cloudflare challenge titles.
- **Audience:** KELA assesses the lure set targets business banking and treasury logins more than retail consumers. Warn treasury and AP staff; feed the naming patterns into brand-protection and DNS watchlists.

Sources: [KELA: Not Actually Suspended — How a Bank-Phishing Network Fakes Its Own Takedown (Nov 3)](https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/) · [SecurityWeek: Bank Phishing Sites Show Fake 'Suspended' Pages to Evade Takedowns (Nov 5)](https://www.securityweek.com/bank-phishing-sites-show-fake-suspended-pages-to-evade-takedowns/)