Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns

A threat actor has utilized fake 'suspended account' notices to conceal phishing content on look-alike bank websites since May. This campaign involves over 300 fake domains, including 248 impersonating 189 US financial institutions, with most appearing between July and September 2026. The mechanism involves a kit that uses a single IP address to serve initial login pages and subsequent 'suspended' notices for returning visitors, termed the ‘Suspended’ infrastructure. These domains frequently use naming patterns incorporating keywords like 'secure', 'disable', 'protect', etc., followed by a hyphen and the bank's name. Some groups are using template names like 'help-desk' and 'live-support' impersonating entities like JPMorgan and Citi, targeting business banking and treasury logins rather than personal accounts. The initial phishing page solicits credentials and includes elements designed to block developer tools, while subsequent pages mimic hosting provider notices to deter security scans.

The infrastructure described relies on creating a mechanism where security scrutiny naturally leads to the display of a 'closed' status, effectively weaponizing legitimate site maintenance procedures against security scanners. The system’s resilience is built upon four pillars: a simple naming formula for scalability across multiple targets, the use of Cloudflare for obfuscation, a repeatable kit that generates deceptive responses based on prior visitor history, and shared servers to ensure persistence beyond single domain takedowns. This moves the attack sophistication from simple content distribution to infrastructure management that anticipates security countermeasures. The core implication is that defenses relying on domain reputation or real-time scanning are susceptible if the malicious artifact itself mimics a known administrative state. The narrative shifts focus away from credential harvesting (which is less efficient) toward exploiting trust in administrative processes, suggesting an adaptation against conventional phishing countermeasures. When evaluating these tactics, one must consider how easily legitimate platform features can be co-opted to create adversarial illusions. What structural vulnerabilities exist in the expectation that site availability correlates directly with account status? What secondary systems—like domain registrars or content delivery networks—are being leveraged to amplify this operational camouflage?