CONNECT WITH US
AI & Deeptech

AI & Deeptech

This clever banking scam keeps phishing by faking its own demise – how it works

ZDNET AI logo

Published on

Add as a preferred source on Google
This clever banking scam keeps phishing by faking its own demise – how it works

You won't see the 'suspended' sign because it's not meant for you.

KELA researchers have exposed an active financial-scam infrastructure that hosts hundreds of fraudulent websites capable of faking their own suspensions to stay online. As of Oct. 25, 2026, 248 financial scam and phishing domains tied to 189 major US banks and financial services have been linked to the same infrastructure.

According to the cybersecurity firm’s report, published on Tuesday, the “Suspended” infrastructure operation runs websites that have cloned the official domains of victim organizations, with a particular focus on business banking. Many domains use the [keyword]-[bank].com format, slotting in keywords such as “secure,” “disable,” “protect,” and “cancel.”

Also: Beware of Bluetooth sniffers: How your favorite gadgets could be exposing your data

A handful of servers spread across two shared hosting providers run the backend of Suspended infrastructure, which has also been tied to phishing campaigns targeting cryptocurrency exchanges and government services in the UK, the Netherlands, Australia, and New Zealand. As a result, the researchers believe that either a single operator is behind the setup or that the server infrastructure is part of a wider phishing-as-a-service platform.

This phishing campaign stands out because of how the cybercriminals behind the scam are protecting it: by issuing takedown notices.

When you visit a website and see a message that it has been taken down or suspended, it’s usually because the domain has been associated with malicious or illegal activity, including phishing and scams. Law enforcement agencies, often with help from technology firms, find these websites, obtain the necessary court orders, and seize the infrastructure or accounts behind them to force a suspension through a registrar or hosting provider.


Source link
Related Topics:AI & Deeptech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.