IP-Tracking Phishing Kit Serves Fake Suspended Pages to 300+ Bank Domains

The campaign registers domains with predictable naming patterns such as secure-bankname or help-desk-bankname, then proxies them through Cloudflare. First-time visitors receive branded business banking login pages with reCAPTCHA and disabled developer tools. Repeat visitors from the same IP see a copied hosting suspension notice. This defeats standard takedown verification that relies on second checks. Kela traced 183 domains still active as of 25 October, with 49 new ones appearing in the prior week. Most target mid-sized US regional banks for treasury and commercial accounts rather than retail logins. Brief direct resolutions revealed shared hosting also used against UK, Australian, and New Zealand institutions. Some domains redirect scanners to Google instead of showing any page. Standard abuse reporting fails because the kit treats security researchers and takedown teams as returning visitors. Cloudflare hides origin servers while the naming template allows rapid regeneration of any targeted bank. The approach exploits the gap between one-time victim clicks and multi-check remediation workflows that assume static malicious content. Expect continued domain churn behind Cloudflare with expanded use of live-support and primary-device templates. Takedown providers will need fresh-IP verification or behavioral fingerprinting to confirm live phishing rather than relying on visible suspension pages.