Phishing site ‘suspended’? Don’t count on it

Let’s say you’ve spotted a phishing site and brought it to your cybersecurity experts’ attention. A few days later, you revisit that site and see a screen that says, “This account has been suspended.”

Game over? Not quite.

The reports of some phishers’ shutdown can be greatly exaggerated—creating a new cybersecurity hazard for IT pros.

Researchers from cyber threat intelligence platform KELA recently observed threat actors acting down and out when their phishing campaigns were, in fact, alive and well. The sly maneuver works if defenders think an attack has been addressed and move on.

While phishers of late have shown they can “cloak” campaigns and set their sites according to specific geolocation, times of day, and devices (like mobile-specific reveals), the threat actors found by KELA take things one step further.

For a start, they determine (via IP address) if you’re a first-time visitor. A new arrival gets the fake bank login page; a repeat visitor receives a page saying “this account has been suspended.”

“The hosting provider’s suspension notice reads as ‘case closed,’ so the report gets marked resolved while the site keeps collecting logins from new visitors,” Elad Ezrahi, VP of research at KELA, wrote to IT Brew. “The operators aren’t really hiding from defenders. They’re telling them the job is done.”

The campaign breaks a workflow most teams trust, according to Ezrahi: report the site, recheck it, close the ticket. A second check from a security team, scanner, or takedown provider gets the decoy.

According to KELA’s blog post, updated on November 9, a single phishing campaign utilizing this technique featured 248 live domains impersonating 189 US financial institutions—most of them mid-size regional banks.

How IT can respond. Ezrahi recommends teams:

• Verify the shutdown from a fresh IP address each time, from more than one location, over several days. (And treat blocking notices, blank pages, and redirects to Google as suspicious, too.)
• Have finance staff reach bank portals through bookmarks or the bank’s app, not links. Confirm any transfer cancellations or authorizations with a bank’s known number.
• Watch newly registered domains for naming patterns that contain words like “secure,” “disable,” “protect,” “cancel,” or “authorize,” combined with a bank’s name.

“A suspended page may only tell you that your IP address has visited before,” Ezrahi wrote.