---
title: Tip: when verifying a reported bank look-alike, always re-check from a fresh IP — the 'Suspended' kit serves a fake takedown page to every returning address | ctxsec
url: https://ctxsec.com/items/tip-hunt-bank-phishing-suspended-page-second-check-new-ip
description: "A second look from the same scanner egress is exactly what this phishing cluster is built to defeat."
status: "confirmed research (KELA, Nov 3)"
published: 2026-11-05
---

> A second look from the same scanner egress is exactly what this phishing cluster is built to defeat.

[← Tips & Guides](/tips) · [markdown](/items/tip-hunt-bank-phishing-suspended-page-second-check-new-ip.md)

confirmed research (KELA, Nov 3)

2026-11-05

### Tip: when verifying a reported bank look-alike, always re-check from a fresh IP — the 'Suspended' kit serves a fake takedown page to every returning address

- Open the URL once from a clean IP. If you see a bank login, capture it, then check again from a **different** IP. A "account suspended" hosting page on the second hit is a strong positive for this kit, not proof the site is gone.
- Prefer residential or diversified egress over a single cloud NAT for brand-protection crawls of finance look-alikes.
- Add the secure-/disable-/protect-/cancel-/authorize-/terminate-/credentials-/commercial- + bank-name patterns (and help-desk / treasury-portal variants) to your domain watchlists.

Sources: [KELA: Not Actually Suspended — How a Bank-Phishing Network Fakes Its Own Takedown](https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/)