A $25 template helped scammers build hundreds of phantom bank domains
A phrase on a suspicious website turned into an investigation of phantom banks built to support scams, according to new research from Allure Security.
Molly DeQuattro, the company’s VP of Operations, was reviewing a domain that resembled the brand of one of its financial services clients. The page carried none of that client’s branding. It presented an unrelated bank instead.
One phrase caught her attention: “one of the largest digital banking providers.” She searched public website source code for the exact wording and found about 2,200 matching domains.
“Why would someone place an invented bank on a domain associated with another brand?” the researchers wrote. “A victim would not confuse it with their existing bank.” That question ruled out brand impersonation and sent the team digging into what these applications could do and where the trail led.
Hundreds of phantom banks share the same cheap website template
The team tried to connect to all 2,200 domains. Just under half, 1,095, returned a working page. Of those, 838 still contained the search phrase.
According to the researchers, 810 of those 838 sites, 97%, retained parts of Cuex, a front-end template sold for currency exchange and digital banking sites for $25 at the time. On top sat Laravel, a PHP framework handling logins, sessions, registration, and account access, found on 94% of the sites. A misspelled heading from the template, “Curreny Charts,” showed up on 90% of them.
Allure Security calls the pattern legitimacy stacking. Banking interfaces, dashboards, investment products, corporate details, and support contacts get layered together so an invented institution looks credible. Among the 838 sites, 770 presented login pages, 767 set session cookies, and 729 contained anti-forgery tokens, the building blocks of an application built to accept and hold user data.
“Taken together, the features observed across these discovered phantom-financial sites fit a familiar fraud model. A broker, romantic contact, loan agent, recovery service, or supposed delivery representative can introduce a victim to an unfamiliar financial institution. The portal gives that story a persistent interface for accounts, balances, investment gains, transfers, holds, and withdrawal problems,” researchers noted.
A sloppy copy exposed an outside connection
One site, branded as Classtands Crest, made an error that let researchers trace it beyond its own domain. Its account-creation page was still titled “Create an Account- Remedy bank” in the source code, a leftover from whatever site it had been copied from.
The registration form was set to send submitted data to a separate domain, remedycodes[.]site. Researchers did not submit the form. That same Remedy address had already turned up as a contact point on two other sites flagged elsewhere for suspected fraud.
The public registration page at classtandscrest[.]com (Source: Allure Security)
What to check
Researchers recommend combining several clues when investigating suspected phantom banks. These include the “Curreny Charts” typo, shared website paths and code, matching cookies and contact details, and forms that send data to the same destination.
They should also independently verify the financial institution’s claims and preserve evidence such as pages, timestamps, hashes, and sources to support their findings.
“A copied sentence can surface a large set of sites,” the researchers concluded. “Understanding how those sites relate requires following the application and tracing the legitimacy stack behind it.”