Bank Phishing Campaign Uses Fake 'Suspended' Pages for Returning Visitors to Evade Takedowns

Key facts for Fake Takedown bank phishing

Detection coverage for Fake Takedown bank phishing

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5324 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake Takedown Bank Phishing — Look-Alike Domain Resolution (Splunk)

Detects DNS resolution of the four published Fake Takedown bank-phishing domains (53primaryset.com, authorize-valley.com, commercial-atfirst.com, protect-pinnaclefp.com), of domains following the campaign's [keyword]-[bankname].com naming formula (secure, disable, protect, cancel, authorize, terminate, credentials, commercial, help-desk, live-support, treasury-portal) and of the numeric 'primary device' variant (e.g. 53primaryset.com). A hit means a user or system attempted to reach cloaked business-banking credential-harvesting infrastructure that fakes its own takedown.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1583.001, T1608.005, T1598, T1036
• Data sources: stream:dns (index=network), Microsoft Defender DeviceNetworkEvents, Microsoft Defender UrlClickEvents, dns logsource
• Severity: high
• Confidence: high

Splunk SPL

index=network sourcetype="stream:dns" earliest=-24h
| eval q=lower(rtrim(query,"."))
| eval ioc_hit=if(match(q,"(^|[.])(53primaryset|authorize-valley|commercial-atfirst|protect-pinnaclefp)[.]com$"),1,0)
| eval pattern_hit=if(match(q,"^(secure|disable|protect|cancel|authorize|terminate|credentials|commercial|help-desk|live-support|treasury-portal)-[a-z0-9-]{3,40}[.]com$"),1,0)
| eval variant_hit=if(match(q,"^[0-9]{2,4}primary[a-z0-9]{2,30}[.]com$"),1,0)
| where ioc_hit=1 OR pattern_hit=1 OR variant_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen dc(src) as client_count values(src) as clients by q ioc_hit pattern_hit variant_hit
| convert ctime(first_seen) ctime(last_seen)
| sort - ioc_hit - count

Microsoft KQL

let iocDomains = dynamic(['53primaryset.com','authorize-valley.com','commercial-atfirst.com','protect-pinnaclefp.com']);
let namingFormula = @'^(secure|disable|protect|cancel|authorize|terminate|credentials|commercial|help-desk|live-support|treasury-portal)-[a-z0-9-]{3,40}[.]com$';
let variantFormula = @'^[0-9]{2,4}primary[a-z0-9]{2,30}[.]com$';
let netEvents = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where isnotempty(RemoteUrl)
| extend Host = tolower(iff(RemoteUrl contains '://', tostring(parse_url(RemoteUrl).Host), RemoteUrl))
| project Timestamp, Host, Source = 'DeviceNetworkEvents', Actor = DeviceName, Process = InitiatingProcessFileName;
let clickEvents = UrlClickEvents
| where Timestamp > ago(24h)
| extend Host = tolower(tostring(parse_url(Url).Host))
| project Timestamp, Host, Source = 'UrlClickEvents', Actor = AccountUpn, Process = ActionType;
union netEvents, clickEvents
| where Host has_any (iocDomains) or Host matches regex namingFormula or Host matches regex variantFormula
| extend KnownIoc = Host has_any (iocDomains)
| summarize Hits=count(), Actors=dcount(Actor), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Sources=make_set(Source), Processes=make_set(Process, 10) by Host, KnownIoc
| order by KnownIoc desc, Hits desc

Sigma

title: Fake Takedown Bank Phishing Look-Alike Domain Lookup (TL-2026-5324)
id: a3f81c47-5d2e-4b96-8e10-7c4d29b6e501
status: experimental
description: Detects DNS queries for the known Fake Takedown bank-phishing domains (53primaryset.com, authorize-valley.com, commercial-atfirst.com, protect-pinnaclefp.com), for domains following the [keyword]-[bankname].com naming formula and for the numeric 'primary device' variant used to impersonate US regional and commercial banks.
references:
    - https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/
    - https://www.securityweek.com/bank-phishing-sites-show-fake-suspended-pages-to-evade-takedowns/
    - https://attack.mitre.org/techniques/T1583/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.resource_development
    - attack.t1583.001
    - attack.t1608.005
    - attack.reconnaissance
    - attack.t1598
    - attack.defense_evasion
    - attack.t1036
logsource:
    category: dns
detection:
    selection_ioc_exact:
        query:
            - '53primaryset.com'
            - 'authorize-valley.com'
            - 'commercial-atfirst.com'
            - 'protect-pinnaclefp.com'
    selection_ioc_sub:
        query|endswith:
            - '.53primaryset.com'
            - '.authorize-valley.com'
            - '.commercial-atfirst.com'
            - '.protect-pinnaclefp.com'
    selection_pattern:
        query|re: '^(secure|disable|protect|cancel|authorize|terminate|credentials|commercial|help-desk|live-support|treasury-portal)-[a-z0-9-]{3,40}\.com$'
    selection_variant:
        query|re: '^[0-9]{2,4}primary[a-z0-9]{2,30}\.com$'
    condition: 1 of selection_*
falsepositives:
    - Legitimate vendor domains that coincidentally use a security keyword prefix
    - Brand-protection or threat-research systems resolving the domains
level: high

Known false positives:

• Legitimate vendor or bank-service domains that coincidentally use a secure-/protect-/commercial- prefix
• Brand-protection vendors or security researchers resolving the look-alike domains

Tuning notes: Known-IOC hits (ioc_hit=1) are high fidelity; naming-pattern and variant hits are medium. Allow-list domains your organisation owns and add your own bank brand strings to a tighter regex. Feed new KELA/OTX domains into the IOC list as they are published (300+ domains exist, only four were published). Adjust the stream:dns index and field names (query, src) to your DNS source.

• 🔒 Fake Takedown Bank Phishing — Look-Alike Domain Connection and URL Click (Sentinel KQL) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — IP-Cloaked Fake 'Suspended' Decoy and Anti-DevTools Page (Sentinel KQL) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — RDP Jump Host Fanning Out Over SSH (Sentinel KQL) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — Look-Alike Domain Lookup (Sigma) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — IP-Cloaked Fake 'Suspended' Decoy and Anti-DevTools Page (Sigma) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — RDP Jump Host Fanning Out Over SSH (Sigma) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — IP-Cloaked Fake 'Suspended' Decoy and Anti-DevTools Page (Splunk) · unlock with TL Creds
• 🔒 Fake Takedown Bank Phishing — RDP Jump Host Fanning Out Over SSH (Splunk) · unlock with TL Creds

Indicators of compromise for Fake Takedown bank phishing

As of 2026-11-05, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5324.

Sample indicators (3 of 9)

• Domain: 53primaryset[.]com
• Domain: authorize-valley[.]com
• Domain: commercial-atfirst[.]com

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

How Fake Takedown bank phishing works

KELA's report 'Bank Phishing Campaign: Fake Takedown' (published 2026-11-03; also circulated as an AlienVault OTX pulse on 2026-11-04 titled 'Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown') documents a large-scale look-alike domain network. KELA counted 248 live domains impersonating 189 US financial institutions as of 2026-10-25, out of more than 300 domains identified since May 2026. Domain registration reportedly began in late 2025 and peaked in the summer (KELA cites August 2026), with 49 new domains appearing in the week before 2026-10-25. Most targets are mid-sized regional and commercial banks rather than national institutions, and many cloned pages are business banking and treasury logins, which offer higher balances and transfer capability. Victim institutions are primarily in the US; the same backend also hosts phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand.

Domains follow a repeatable naming formula of [keyword]-[bank].com. Urgency keywords include secure, disable, protect, cancel, authorize, terminate, credentials and commercial. Newer templates use help-desk, live-support, treasury-portal and 'primary device' variants; roughly half of the domains seen in the final observed week used help-desk or live-chat variants. Examples listed in the OTX pulse: 53primaryset.com, authorize-valley.com, commercial-atfirst.com and protect-pinnaclefp.com.

The phishing kit remembers visitor IP addresses. A first visit returns a Bootstrap-style login form carrying the bank's branding (with a Company ID field for business banking clones and, on some deployments, a reCAPTCHA gate). Any later visit from the same IP returns a fake 'account suspended' notice that imitates a hosting-provider takedown, so security checkers, researchers and takedown vendors who look twice see an apparently dead site. Browser tab titles copy Cloudflare's 'Attention required' challenge page, and a script blocks developer tools. Some domains instead serve a blocking notice, a blank page or a Google redirect as the decoy.

Infrastructure is fronted by Cloudflare, which hides the origin hosting. Brief gaps exposed the underlying servers: a handful of addresses at two shared-hosting providers that outlast any single domain. KELA observed a management server set up on 2026-10-09 that logs into the US-bank hosting control panel, and all backend hosts are administered over SSH from a single jump server that is itself reached by Remote Desktop from a UK residential broadband connection, which KELA calls the strongest lead to the operator. The shared backend suggests either a single operator or a phishing-as-a-service platform. The initial distribution vector (how victims are lured to the domains) was not identified. No attribution to a named actor is made. KELA offers a free 'Bank Phishing Check' tool for institutions. No specific IP addresses or file hashes were published in the sources reviewed; BeaconBeagle correlation was not possible as no network IP IOCs are available.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 SSH

Defense Evasion

T1036 Masquerading; T1480 Execution Guardrails; T1622 Debugger Evasion

Resource Development

T1583.001 Domains; T1608.005 Link Target

Reconnaissance

T1598 Phishing for Information

Remediation for Fake Takedown bank phishing

Immediate actions

• Block and sinkhole the published look-alike domains (53primaryset.com, authorize-valley.com, commercial-atfirst.com, protect-pinnaclefp.com) at DNS and web proxy
• Hunt newly registered domain and certificate-transparency feeds for the [keyword]-[bankname] naming pattern with keywords such as secure, disable, protect, cancel, authorize, terminate, credentials, commercial, help-desk, live-support and treasury-portal
• Submit takedown requests even when a site shows a 'suspended' page: a live domain can be masquerading as inactive, so verify from a fresh IP before closing a case
• Alert business banking and treasury customers to the campaign and tell them to reach the bank only via bookmarked or known URLs

Workarounds

• Use KELA's free Bank Phishing Check tool to assess exposure
• Treat reports of domains showing 'account suspended' or Cloudflare-style 'Attention required' tab titles with bank branding as suspected cloaked phishing

Longer-term hardening

• Monitor brand and domain impersonation continuously, including look-alike registrations that embed your institution name
• Enforce phishing-resistant MFA (FIDO2/passkeys) and transaction verification on business banking and treasury portals
• Add out-of-band callback verification for new payees and high-value transfers
• Re-check reported phishing URLs from multiple egress IPs and over time to defeat IP-based cloaking

Affected and fixed versions

• Various — US regional and commercial banks and credit institutions (business banking and treasury portals)
  Vulnerable versions: 189 impersonated US financial institutions per KELA

Timeline of Fake Takedown bank phishing

• 2025-12-01 First domains in the network were registered in late 2025, months before the campaign went live (SecurityWeek summary of locked-ioc-9; exact day not stated, month approximated)
• 2026-05-01 Phishing campaign becomes active; locked-ioc-9 dates activity from May 2026 (exact day not stated)
• 2026-08-01 Domain registration waves peak in the summer months, with locked-ioc-9 citing August 2026 (exact day not stated)
• 2026-10-09 Management server that logs into the US-bank hosting control panel is established; all backend hosts are managed over SSH from a single jump server reached via RDP from a UK residential connection
• 2026-10-18 Week before the snapshot: 49 new domains appear, about half using help-desk or live-chat naming variants (approximate week start)
• 2026-10-25 locked-ioc-9 snapshot counts 248 live look-alike domains impersonating 189 US financial institutions, out of 300+ identified since May 2026; 183 of the 300+ still live per SecurityWeek
• 2026-11-03 locked-ioc-9 publishes 'Bank Phishing Campaign: Fake Takedown' describing the IP-tracking fake 'suspended' page
• 2026-11-04 Report circulated as an AlienVault OTX pulse (TLP:White) listing four example domains
• 2026-11-05 SecurityWeek reports on the campaign and its takedown-evasion technique

Sources cited for Fake Takedown bank phishing

• MITRE ATT&CK T1583.001 Acquire Infrastructure: Domains MITRE · Advisory · 2026-11-03
• MITRE ATT&CK T1480 Execution Guardrails MITRE · Advisory · 2026-11-03
• Bank Phishing Campaign: Fake Takedown (KELA) kelacyber.com · Research · 2026-11-03
• Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown (AlienVault OTX pulse via OffSeq Radar) radar.offseq.com · Research · 2026-11-04
• KELA Brand Control (digital risk and brand protection) lumint.ke-la.com · Vendor report · 2026-11-03
• Bank Phishing Sites Show Fake 'Suspended' Pages to Evade Takedowns (SecurityWeek) SecurityWeek · News · 2026-11-05

More in phishing

• Fake holiday rental booking phishing sites use live chat to harvest traveler credentials and card data
• ChatGPT Subscription Payment Phishing Campaign Using Google API Redirect and Fake Login Page
• Fake OpenAI, SpaceX and Anthropic events used in device code and AiTM phishing to steal Microsoft and Google accounts
• Microsoft Q3 2026 Email Threat Landscape: Device Code Phishing via QR Salary-Review Lures and Agent Tesla RAR Campaign
• Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations