# Bank Phishing Campaign Uses Fake 'Suspended' Pages for Returning Visitors to Evade Takedowns

> KELA reports a phishing campaign active since May 2026 with 300+ look-alike domains impersonating 189 US financial institutions, mainly mid-sized regional banks, focused on business banking and treasury logins. The kit tracks visitor IPs: first-time visitors get a bank login clone, returning visitors get a fake hosting 'account suspended' page so live domains appear already taken down.

- **Published:** 2026-11-05T13:39:45Z
- **Last reviewed:** 2026-11-05T13:39:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5324
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5324.png
- **ID:** TL-2026-5324
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (3 shown free below)

## Description

KELA's report 'Bank Phishing Campaign: Fake Takedown' (published 2026-11-03; also circulated as an AlienVault OTX pulse on 2026-11-04 titled 'Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown') documents a large-scale look-alike domain network. KELA counted 248 live domains impersonating 189 US financial institutions as of 2026-10-25, out of more than 300 domains identified since May 2026. Domain registration reportedly began in late 2025 and peaked in the summer (KELA cites August 2026), with 49 new domains appearing in the week before 2026-10-25. Most targets are mid-sized regional and commercial banks rather than national institutions, and many cloned pages are business banking and treasury logins, which offer higher balances and transfer capability. Victim institutions are primarily in the US; the same backend also hosts phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand.

Domains follow a repeatable naming formula of [keyword]-[bank].com. Urgency keywords include secure, disable, protect, cancel, authorize, terminate, credentials and commercial. Newer templates use help-desk, live-support, treasury-portal and 'primary device' variants; roughly half of the domains seen in the final observed week used help-desk or live-chat variants. Examples listed in the OTX pulse: 53primaryset.com, authorize-valley.com, commercial-atfirst.com and protect-pinnaclefp.com.

The phishing kit remembers visitor IP addresses. A first visit returns a Bootstrap-style login form carrying the bank's branding (with a Company ID field for business banking clones and, on some deployments, a reCAPTCHA gate). Any later visit from the same IP returns a fake 'account suspended' notice that imitates a hosting-provider takedown, so security checkers, researchers and takedown vendors who look twice see an apparently dead site. Browser tab titles copy Cloudflare's 'Attention required' challenge page, and a script blocks developer tools. Some domains instead serve a blocking notice, a blank page or a Google redirect as the decoy.

Infrastructure is fronted by Cloudflare, which hides the origin hosting. Brief gaps exposed the underlying servers: a handful of addresses at two shared-hosting providers that outlast any single domain. KELA observed a management server set up on 2026-10-09 that logs into the US-bank hosting control panel, and all backend hosts are administered over SSH from a single jump server that is itself reached by Remote Desktop from a UK residential broadband connection, which KELA calls the strongest lead to the operator. The shared backend suggests either a single operator or a phishing-as-a-service platform. The initial distribution vector (how victims are lured to the domains) was not identified. No attribution to a named actor is made. KELA offers a free 'Bank Phishing Check' tool for institutions. No specific IP addresses or file hashes were published in the sources reviewed; BeaconBeagle correlation was not possible as no network IP IOCs are available.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.005 Link Target
- T1598 Phishing for Information
- T1036 Masquerading
- T1480 Execution Guardrails
- T1622 Debugger Evasion
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake Takedown Bank Phishing — Look-Alike Domain Resolution (Splunk)** (`TL-2026-5324-SPL-001`)

Detects DNS resolution of the four published Fake Takedown bank-phishing domains (53primaryset.com, authorize-valley.com, commercial-atfirst.com, protect-pinnaclefp.com), of domains following the campaign's [keyword]-[bankname].com naming formula (secure, disable, protect, cancel, authorize, terminate, credentials, commercial, help-desk, live-support, treasury-portal) and of the numeric 'primary device' variant (e.g. 53primaryset.com). A hit means a user or system attempted to reach cloaked business-banking credential-harvesting infrastructure that fakes its own takedown.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1608.005, T1598, T1036
- **Data sources:** stream:dns (index=network), Microsoft Defender DeviceNetworkEvents, Microsoft Defender UrlClickEvents, dns logsource
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="stream:dns" earliest=-24h
| eval q=lower(rtrim(query,"."))
| eval ioc_hit=if(match(q,"(^|[.])(53primaryset|authorize-valley|commercial-atfirst|protect-pinnaclefp)[.]com$"),1,0)
| eval pattern_hit=if(match(q,"^(secure|disable|protect|cancel|authorize|terminate|credentials|commercial|help-desk|live-support|treasury-portal)-[a-z0-9-]{3,40}[.]com$"),1,0)
| eval variant_hit=if(match(q,"^[0-9]{2,4}primary[a-z0-9]{2,30}[.]com$"),1,0)
| where ioc_hit=1 OR pattern_hit=1 OR variant_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen dc(src) as client_count values(src) as clients by q ioc_hit pattern_hit variant_hit
| convert ctime(first_seen) ctime(last_seen)
| sort - ioc_hit - count
```

### Microsoft KQL

```kql
let iocDomains = dynamic(['53primaryset.com','authorize-valley.com','commercial-atfirst.com','protect-pinnaclefp.com']);
let namingFormula = @'^(secure|disable|protect|cancel|authorize|terminate|credentials|commercial|help-desk|live-support|treasury-portal)-[a-z0-9-]{3,40}[.]com$';
let variantFormula = @'^[0-9]{2,4}primary[a-z0-9]{2,30}[.]com$';
let netEvents = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where isnotempty(RemoteUrl)
| extend Host = tolower(iff(RemoteUrl contains '://', tostring(parse_url(RemoteUrl).Host), RemoteUrl))
| project Timestamp, Host, Source = 'DeviceNetworkEvents', Actor = DeviceName, Process = InitiatingProcessFileName;
let clickEvents = UrlClickEvents
| where Timestamp > ago(24h)
| extend Host = tolower(tostring(parse_url(Url).Host))
| project Timestamp, Host, Source = 'UrlClickEvents', Actor = AccountUpn, Process = ActionType;
union netEvents, clickEvents
| where Host has_any (iocDomains) or Host matches regex namingFormula or Host matches regex variantFormula
| extend KnownIoc = Host has_any (iocDomains)
| summarize Hits=count(), Actors=dcount(Actor), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Sources=make_set(Source), Processes=make_set(Process, 10) by Host, KnownIoc
| order by KnownIoc desc, Hits desc
```

### Sigma

```yaml
title: Fake Takedown Bank Phishing Look-Alike Domain Lookup (TL-2026-5324)
id: a3f81c47-5d2e-4b96-8e10-7c4d29b6e501
status: experimental
description: Detects DNS queries for the known Fake Takedown bank-phishing domains (53primaryset.com, authorize-valley.com, commercial-atfirst.com, protect-pinnaclefp.com), for domains following the [keyword]-[bankname].com naming formula and for the numeric 'primary device' variant used to impersonate US regional and commercial banks.
references:
    - https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/
    - https://www.securityweek.com/bank-phishing-sites-show-fake-suspended-pages-to-evade-takedowns/
    - https://attack.mitre.org/techniques/T1583/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.resource_development
    - attack.t1583.001
    - attack.t1608.005
    - attack.reconnaissance
    - attack.t1598
    - attack.defense_evasion
    - attack.t1036
logsource:
    category: dns
detection:
    selection_ioc_exact:
        query:
            - '53primaryset.com'
            - 'authorize-valley.com'
            - 'commercial-atfirst.com'
            - 'protect-pinnaclefp.com'
    selection_ioc_sub:
        query|endswith:
            - '.53primaryset.com'
            - '.authorize-valley.com'
            - '.commercial-atfirst.com'
            - '.protect-pinnaclefp.com'
    selection_pattern:
        query|re: '^(secure|disable|protect|cancel|authorize|terminate|credentials|commercial|help-desk|live-support|treasury-portal)-[a-z0-9-]{3,40}\.com$'
    selection_variant:
        query|re: '^[0-9]{2,4}primary[a-z0-9]{2,30}\.com$'
    condition: 1 of selection_*
falsepositives:
    - Legitimate vendor domains that coincidentally use a security keyword prefix
    - Brand-protection or threat-research systems resolving the domains
level: high
```

**Known false positives:**

- Legitimate vendor or bank-service domains that coincidentally use a secure-/protect-/commercial- prefix
- Brand-protection vendors or security researchers resolving the look-alike domains

**Tuning notes:** Known-IOC hits (ioc_hit=1) are high fidelity; naming-pattern and variant hits are medium. Allow-list domains your organisation owns and add your own bank brand strings to a tighter regex. Feed new KELA/OTX domains into the IOC list as they are published (300+ domains exist, only four were published). Adjust the stream:dns index and field names (query, src) to your DNS source.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Takedown Bank Phishing — Look-Alike Domain Connection and URL Click (Sentinel KQL) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — IP-Cloaked Fake 'Suspended' Decoy and Anti-DevTools Page (Sentinel KQL) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — RDP Jump Host Fanning Out Over SSH (Sentinel KQL) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — Look-Alike Domain Lookup (Sigma) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — IP-Cloaked Fake 'Suspended' Decoy and Anti-DevTools Page (Sigma) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — RDP Jump Host Fanning Out Over SSH (Sigma) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — IP-Cloaked Fake 'Suspended' Decoy and Anti-DevTools Page (Splunk) (locked: unlock with TL Creds)
- Fake Takedown Bank Phishing — RDP Jump Host Fanning Out Over SSH (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 9)

Defanged, TLP:CLEAR.

- Domain: `53primaryset[.]com`
- Domain: `authorize-valley[.]com`
- Domain: `commercial-atfirst[.]com`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Bank Phishing Sites Show Fake 'Suspended' Pages to Evade Takedowns (SecurityWeek)](https://www.securityweek.com/bank-phishing-sites-show-fake-suspended-pages-to-evade-takedowns/)
- [Bank Phishing Campaign: Fake Takedown (KELA)](https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/)
- [Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown (AlienVault OTX pulse via OffSeq Radar)](https://radar.offseq.com/threat/not-actually-suspended-how-a-bank-phishing-network-fakes-its-own-takedown-9f2c917307e17b2b)
- [KELA Brand Control (digital risk and brand protection)](https://lumint.ke-la.com/platform/brand-control/)
- [MITRE ATT&CK T1583.001 Acquire Infrastructure: Domains](https://attack.mitre.org/techniques/T1583/001/)
- [MITRE ATT&CK T1480 Execution Guardrails](https://attack.mitre.org/techniques/T1480/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5324