BANK PHISHING SITES SHOW FAKE ‘SUSPENDED' PAGES TO EVADE TAKEDOWNS

Summary from the TLDR InfoSec newsletter

Kela found more than 300 fake bank domains using a phishing kit that records visitor IP addresses. First visits receive bank login pages. Repeat visits receive a fake hosting "suspended" notice. This can make takedown teams classify live sites as inactive. The campaign targets business banking and treasury logins at 189 US institutions, with activity also seen in the UK, Australia, and New Zealand.