Researchers have reported a phishing campaign in which bank-themed fraudulent websites behaved differently depending on who visited them. According to the report referenced by SecurityWeek, more than 200 sites served phishing pages to first-time visitors but showed fake “suspended” pages to users who returned later. This kind of selective behaviour is designed to make malicious sites look inactive when they are reviewed again by analysts, hosting providers, or abuse teams.

What happened

The reported tactic relies on conditional content delivery. A visitor may see a live phishing page on the first visit, but a second visit can produce a message suggesting the site has been suspended or taken offline. In practice, this can interfere with verification by security researchers, domain registrars, hosting providers, and internal security teams that revisit a URL to confirm abuse before blocking or removing it.

The available report summary points specifically to bank phishing sites, but the underlying method is relevant more broadly. Similar evasion techniques can be used in campaigns targeting payment accounts, business email credentials, SaaS logins, or administrative access to company systems.

Why it matters for European businesses

For European businesses, this development matters because phishing operations increasingly use techniques that reduce the effectiveness of traditional response processes. If a malicious site appears harmless on review, takedowns may be delayed, detection rules may be weakened, and incident responders may need more evidence before acting.

This has several practical consequences:

• Slower takedowns: Abuse teams and providers may not immediately see the phishing content when they recheck reported URLs.
• Higher fraud risk: Customers, employees, or finance teams may still be exposed while the site remains online.
• Harder investigations: Security teams may need better collection methods, such as preserving first-visit evidence, screenshots, headers, and network telemetry.
• Brand exposure: Financial institutions are the direct target here, but any business with online accounts, customer portals, or payment workflows can face similar impersonation attempts.

For SMEs, the risk is not limited to banks. Many phishing campaigns reuse the same infrastructure and evasion methods for Microsoft 365 logins, e-commerce back offices, payroll systems, invoice approvals, and cloud administration panels.

Who may be affected

• Banks, fintechs, and payment providers whose brands are commonly impersonated in phishing campaigns.
• E-commerce businesses that rely on customer trust, payment workflows, and account logins.
• SMEs and founders whose staff may be targeted through finance, payroll, or supplier impersonation.
• IT and security teams responsible for phishing response, domain monitoring, and abuse reporting.
• Digital agencies and managed service providers that monitor client brands, websites, and hosting environments.

What companies should consider

• Treat first-visit evidence as important: When staff or customers report a suspicious site, capture screenshots, page source, timestamps, and URLs immediately. A later revisit may not show the same content.
• Improve reporting workflows: Internal phishing escalation processes should note that malicious pages may change behaviour between visits or by visitor profile.
• Use multiple validation methods: Where possible, combine browser evidence with DNS, hosting, certificate, and network data before concluding that a site is inactive.
• Strengthen user protections: Multi-factor authentication, conditional access, and payment approval controls can reduce damage if credentials are harvested.
• Monitor for brand impersonation: Businesses with public-facing brands, portals, or payment journeys should review domain monitoring and takedown support arrangements.
• Train finance and customer-facing teams: Employees should know that a site appearing “suspended” later does not mean the original alert was false.

While the current report concerns bank phishing pages, the wider lesson is that phishing infrastructure is becoming more adaptive. European businesses should assume that some fraudulent sites are built to deceive not only victims, but also the security and compliance processes used to remove them.