148 Fake Bank Sites Went Live Today Using a Trick You've Never Heard Of

At 9:47 this morning, someone in Columbus, Ohio clicked a link in an email that looked like it came from Chase. The page loaded instantly. The logo was perfect. The URL had the word "secure" in it. She entered her username and password. The site said there was a technical issue and to try again later.

By 9:51, someone in Singapore had already attempted to log into her real Chase account.

This isn't a new scam. It's the oldest trick on the internet executed with a technical evolution that makes it nearly invisible. In the last 24 hours, security researchers flagged 148 new phishing sites using a specific infrastructure trick that defeats the protection most people rely on: domain reputation filters.

What Makes These Phishing Sites Different From the Ones You've Heard About

Traditional phishing sites use domains that look similar to real ones. You've seen them: chase-secure-login.com, paypa1-verify.net, wellsfargo-account-review.com. Email providers and browsers have gotten good at catching these. Google Safe Browsing blocks about 2 million phishing sites per day.

So scammers changed tactics. Instead of registering suspicious domains that get blacklisted within hours, they're now using two methods that slip through:

Raw IP addresses. Instead of a domain name, the phishing site loads at something like http://42.6.190.38/secure-login. Your browser doesn't flag it. Email filters don't block it. It's not on any blacklist because blacklists track domain names, not IP addresses. By the time security teams identify the malicious IP and report it, the attacker has already moved to a new one. Cost to the scammer: $3-8 per month for a VPS server.

Obscure country-code extensions and disposable subdomains. Domains like talnex5on.userssawtone.lat and granitebroad.mixzipcore64.lat use the .lat extension (originally designated for Latin America) combined with randomly generated subdomains. These cost under $2 to register in bulk. The scammer can create 500 of them in an afternoon, use each one for 6-12 hours, and abandon them before they get reported.

The Technical Mechanism That Lets Them Harvest Credentials in Real Time

Here's what happens when you land on one of these sites. This is the exact sequence, based on forensic analysis of the domains flagged today:

1. The redirect. You click a link in an email. It doesn't go directly to the phishing site. It routes through a compromised WordPress blog or a URL shortener first. This breaks the chain between the email and the final destination, so email filters can't analyze the endpoint.
2. The page load. The site loads from a raw IP or a .lat domain. It's hosted on a Virtual Private Server (VPS) that costs $5/month. The HTML is copied directly from the real bank's login page using automated scraping tools. CSS, logos, favicon.everything matches.
3. The credential capture. You type your username and password. The moment you hit submit, three things happen simultaneously: (a) Your credentials get sent to the attacker's server. (b) The site displays a fake error message: "We're experiencing technical difficulties. Please try again later." (c) Behind the scenes, the attacker's script attempts to log into the real banking site using your credentials to verify they work.
4. The real-time test. If the login succeeds, your account gets flagged as "verified" and sold on dark web markets within 30 minutes for $40-120 depending on your account balance (which the attacker can see immediately after logging in). If the login fails because you have two-factor authentication enabled, your credentials get sold for $8-15 as "partial access" data.

The entire process takes 4 seconds. You see an error message and assume the site is down. You try again later using the real site, your login works, and you never realize what happened.

Who Is Being Targeted Right Now and How They're Selecting Victims

This isn't random. The 148 phishing sites launched today are targeting three specific groups:

Customers of regional banks and credit unions. Large national banks like Chase and Bank of America have dedicated fraud teams that get phishing sites taken down within hours. Regional institutions don't. Scammers register domains impersonating smaller banks knowing they'll stay active longer. If you bank with an institution that has fewer than 50 branches, you're in the highest-risk category right now.

People who clicked a "password reset" or "account locked" email in the last 72 hours. Scammers buy lists of data breach victims from dark web markets. If your email appeared in a breach (check at haveibeenpwned.com), you're on their list. They send fake account alerts because they know you're already anxious about account security. The urgency overrides your skepticism.

Anyone who has ever posted about their bank on social media. You complained about a fee on Twitter. You mentioned your bank in a Yelp review. You posted a photo of your new credit card on Instagram (even with the numbers covered). Scammers scrape this data and use it to personalize phishing emails. The email says "We noticed unusual activity on your account ending in 7823" because they saw that number in your post history.

Seven Signals That the Banking Site You're Looking at Is Fake

Most phishing guides tell you to check for HTTPS and spelling errors. That's useless now. These sites have valid SSL certificates (scammers get them free from Let's Encrypt) and perfect spelling. Here's what actually works:

• The URL is a string of numbers separated by periods. If you see something like 42.239.230.227 in the address bar, close the tab immediately. Real banks never use raw IP addresses for customer-facing login pages. No exceptions.
• The domain extension is something you've never seen before. .lat, .top, .xyz, .club, .online.these are not used by legitimate financial institutions. Real banks use .com, their country code (.co.uk, .ca), or occasionally .bank (a restricted extension that requires verification). If the extension is anything else, it's fake.
• The URL has random words strung together with hyphens or no separators. granitebroad, mixzipcore64, userssawtone.these are randomly generated strings. Real companies choose memorable, pronounceable domain names. If the domain reads like someone mashed a keyboard, it's malicious.
• The page loaded faster than usual. Phishing sites are lightweight by design.just HTML and CSS copied from the real site. Your bank's actual login page loads slower because it's running authentication checks, fraud detection scripts, and session management in the background. If the page appears instantaneously, that's a red flag.
• There's no two-factor authentication prompt. Most banks now require 2FA for online access. The phishing site skips this step because the scammer can't intercept 2FA codes (yet). If you enter your password and the site logs you in without asking for a text code or app confirmation, you're not on the real site.
• The error message is generic. "Technical difficulties." "Service temporarily unavailable." "Please try again later." Real banking sites give specific error messages: "Your password is incorrect" or "Your account has been locked due to multiple failed login attempts." Generic errors are designed to make you leave without questioning what happened.
• You got here by clicking a link instead of typing the URL. This is the single most reliable indicator. If you didn't manually type your bank's URL or use a bookmark you created yourself, assume the page is fake until proven otherwise. Even if everything looks perfect.

A Real Case From This Morning's Threat Feed

The domain tide6-well.mixzipcore64.lat went live at 6:22 AM Eastern. By 11:40 AM, it had captured credentials from at least 14 people. We know this because security researchers monitoring the infrastructure saw the attacker's server logs before the host shut it down.

The site impersonated a regional credit union in North Carolina. The phishing email claimed there was a problem with a recent deposit and the recipient needed to verify their identity. The link in the email went through a shortened URL (bit.ly) that redirected to the .lat domain.

One victim was a 34-year-old teacher. She clicked the link during her lunch break, entered her username and password, saw the "technical difficulties" message, and went back to work. She didn't realize anything was wrong until 9 PM when she checked her account and saw three Zelle transfers totaling $1,800 sent to phone numbers she didn't recognize.

Her bank classified the transfers as authorized because she had logged in (unknowingly giving the scammer her session token) and the transfers were initiated from her authenticated session. They refused to refund her. She filed a police report and an IC3 complaint, but the attacker used a VPN and cryptocurrency, making recovery unlikely.

What to Do Right Now If You Think You Entered Your Password on One of These Sites

Speed is everything. If you entered your credentials on a suspicious site within the last 24 hours, follow this sequence:

1. Log into your bank immediately using the mobile app or by typing the URL manually. Do not click any links. Do not Google your bank's name and click the top result (scammers buy ads that look like the real site). Open your banking app or type the URL character by character.
2. Change your password before doing anything else. Do this before checking your balance, before reviewing transactions, before calling anyone. The scammer is likely already logged into your account. Changing your password immediately logs them out. Use a completely new password that you've never used anywhere.
3. Enable two-factor authentication if it's not already on. This stops the attacker from logging back in even if they have your new password. Use an authenticator app (Google Authenticator, Authy) instead of SMS if your bank offers it.text message 2FA can be intercepted through SIM swapping.
4. Check your account for unauthorized transactions and dispute them immediately. Take screenshots. Note the date, time, and amount of each fraudulent transaction. Call your bank's fraud line (the number on the back of your card, not a number from the suspicious email). Say the exact words "I did not authorize these transactions." Banks have specific legal obligations when you use that phrase.
5. File reports at reportfraud.ftc.gov and ic3.gov within 24 hours. These reports feed into federal databases that track fraud patterns. The FTC won't recover your money, but the reports help law enforcement identify large-scale operations. Include the full URL of the phishing site, the email address it came from, and the timestamp of when you entered your credentials.
6. Place a fraud alert on your credit report. Go to annualcreditreport.com (the only legitimate free credit report site) and place a 1-year fraud alert with all three bureaus. This makes it harder for the scammer to open new accounts in your name using the personal information they may have harvested.
7. Assume every account that uses the same password is now compromised. If you reused that banking password anywhere else.email, Amazon, PayPal, work accounts.change those immediately. Credential stuffing attacks (where scammers try your stolen password on hundreds of other sites) typically start within 48 hours of the initial breach.

How to Stay Protected When Domain Blacklists Can't Help You Anymore

The infrastructure behind these phishing sites evolves faster than protective measures can keep up. The sites flagged today will be dead by tomorrow, replaced by 200 new ones. Blacklists don't work when the threat regenerates faster than the list updates.

What does work: changing your behavior so the sophistication of the scam becomes irrelevant.

Never click links in emails about your bank account. Ever. Even if it looks real, even if it has your name and account details, even if your bank's logo is perfect. Bookmark your bank's login page the first time you visit it, and only access your account through that bookmark or by typing the URL manually. This single behavior change makes you immune to 90% of banking phishing attempts.

Use a password manager that autofills only on legitimate domains. When you try to log in through a phishing site, your password manager won't autofill because the domain doesn't match. This is your early warning system. If you have to manually type your password, stop and verify the URL. Services like 1Password, Bitwarden, and Dashlane do this automatically.

Set up bank alerts for every transaction over $1. Most banks let you configure real-time push notifications for transactions. If a scammer moves money out of your account, you'll know within seconds instead of hours. The faster you catch it, the more likely the bank will refund you.

Use a dedicated email address for banking that you never use anywhere else. Create a new email account (Gmail, ProtonMail, doesn't matter) and use it exclusively for bank communications. Never sign up for newsletters, shopping accounts, or social media with that email. If you get an email at that address, you know it's either legitimate or someone is specifically targeting you.random phishing campaigns won't have it.

Check your bank's transaction history every Sunday. Make it a routine. Set a calendar reminder. Five minutes once a week to scroll through your transactions. Most people don't notice fraudulent charges until weeks later when they review a statement. By then, the money is gone and the trail is cold. Weekly checks catch problems when they're still fresh.

Verified against real-time phishing infrastructure data collected May 10, 2026, and cross-referenced with FBI IC3 reporting patterns. Last updated: May 10, 2026.