// ZDNET — CYBERSECURITY
This clever banking scam keeps phishing by faking its own demise – how it works
You won't see the 'suspended' sign because it's not meant for you.
KELA researchers have exposed an active financial-scam infrastructure that hosts hundreds of fraudulent websites capable of faking their own suspensions to stay online. As of Oct. 25, 2026, 248 financial scam and phishing domains tied to 189 major US banks and financial services have been linked to the same infrastructure.
According to the cybersecurity firm’s report, published on Tuesday, the “Suspended” infrastructure operation runs websites that have cloned the official domains of victim organizations, with a particular focus on business banking. Many domains use the [keyword]-[bank].com format, slotting in keywords such as “secure,” “disable,” “protect,” and “cancel.”
Also: Beware of Bluetooth sniffers: How your favorite gadgets could be exposing your data
A handful of servers spread across two shared hosting providers run the backend of Suspended infrastructure, which has also been tied to phishing campaigns targeting cryptocurrency exchanges and government services in the UK, the Netherlands, Australia, and New Zealand. As a result, the researchers believe that either a single operator is behind the setup or that the server infrastructure is part of a wider phishing-as-a-service platform.
This phishing campaign stands out because of how the cybercriminals behind the scam are protecting it: by issuing takedown notices.
When you visit a website and see a message that it has been taken down or suspended, it’s usually because the domain has been associated with malicious or illegal activity, including phishing and scams. Law enforcement agencies, often with help from technology firms, find these websites, obtain the necessary court orders, and seize the infrastructure or accounts behind them to force a suspension through a registrar or hosting provider.
You see the notice, you move on — and this also goes for scanners and security teams.
However, in this case, the scam artists created a mechanism to show it themselves, to avoid being flagged and taken down. But it’s when they show it that matters.
The false suspension notice appears deceptively simple at first glance. A phishing kit embedded in the domain registers the IP address of each visitor, and on their second visit, they are shown a fake “account suspended” page. The kit is disguised as a challenge page similar to those legitimately used by Cloudflare.