Allure Security uncovers 2,200 phantom bank domains

Allure Security has identified about 2,200 domains linked to what it describes as phantom bank websites. It found the sites through a repeated phrase in public website source code.

The research began after Molly DeQuattro, Vice President of Operations at Allure Security, reviewed a suspicious domain that resembled a financial services client's brand but displayed an unrelated bank website. One sentence on that page, "one of the largest digital banking providers," prompted a broader search that returned roughly 2,200 matching domains.

Investigators then tested all of those domains using the same collection method. Of the total, 1,095 returned a live webpage, while 838 still contained the exact phrase that first drew attention to the network.

Among those 838 sites, 810 retained traces of Cuex, a commercially available template for currency exchange and money transfer websites. At the time of the research, the template was priced at USD $25.

The sites were not simply static pages dressed up to resemble banks. Allure's analysis found that 770 of the 838 sites presented login pages, 767 set session cookies, and 729 included references to anti-forgery tokens. Those signs suggest the sites used a working web application layer rather than a simple front-end design.

Allure also found that 790 of the sites showed signs of Laravel, a PHP framework widely used to build web applications. The combination of a low-cost design template and reusable server-side code helped produce websites that looked and behaved like legitimate financial institutions.

That design was often reinforced with the kinds of features customers would expect from a bank or investment platform. Public pages referred to card services on 832 domains, transfer services on 826, account registration on 824, loans or mortgages on 808, and investment or trading services on 786.

In some cases, the public code exposed more of the sites' internal structure. One site's login page contained a Laravel Ziggy route map with 59 named routes, describing functions including customer search, administration, know-your-customer reviews, transaction management, cards, wallets, deposits, transfers, one-time password prompts, password resets, and account verification.

Allure said it did not attempt to use those routes or access non-public parts of the applications. Its analysis was limited to public pages, source code, and public records.

Common traces

A repeated typo helped support the clustering. The heading "Curreny Charts," inherited from the Cuex template, appeared on 756 of the 838 phrase-matching sites.

Researchers also found source code comments suggesting copy-and-adapt workflows across differently branded sites. Some pages included developer notes such as "matches Site A" and "Applies to all sections from Site B," while another retained a comment from HTTrack, a website-copying program.

Those traces pointed to a shared implementation family, though Allure stopped short of attributing all of the domains to one operator. Shared code could reflect a common developer, a kit seller or reseller, a shared deployment process, or a mix of those factors.

Fraud links

One of the clearer connections involved a site called Classtands Crest. Although the site presented itself under that name, its public registration page carried the title "Create an Account- Remedy bank," and its source code retained Remedy-related names and asset paths.

More significantly, the registration form was configured to send submitted details to remedycodes[.]site/register. The form asked for identity and contact details, account type, a PIN, and a password, though Allure said it did not submit any information.

That same Remedy domain had been listed elsewhere as contact information for sites reported by outside fraud researchers. Artists Against 419, a volunteer anti-fraud project, documented support@remedycodes[.]site for Flipbridge Assets, which it categorised as loan and investment fraud. A review by TraderKnows of Thefundtrd also listed the same Remedy address as its only contact and gave the platform a "Suspected Fraud" status.

Allure said the evidence did not prove common control of those sites, but argued that the reused branding and stale form destination created a traceable link that went beyond simple visual similarity.

Public record checks

Allure also examined corporate claims and regulatory references made on the websites. In one case, a live site using the name Upward Saver Bank Corporation claimed UK company number 07325299, but Companies House records for that number belonged to CDC Solutions Ltd, a different business that was dissolved in 2012.

Elsewhere, a single phone number with a Nigerian country code appeared on ten live domains in the data set. Public reporting had also linked the same number to another site that Artists Against 419 had listed as a fake bank.

Twelve sites claimed protection from the US Federal Deposit Insurance Corporation. None of the domains appeared in the FDIC's BankFind records, and 11 of the institution names shown on the sites were absent from the regulator's database, according to Allure.

The phrase that first revealed the network is already becoming less useful as operators edit text or abandon domains. Even so, Allure found that technical markers, including shared assets, page structure, cookie behaviour, chat identifiers, and cross-domain form destinations, remained more durable indicators of links between the sites.

"A copied sentence can surface a large set of sites. Understanding how those sites relate requires following the application and tracing the legitimacy stack behind it. Bank-like functions, compliance claims, corporate identities, and support infrastructure work together to make an invented institution appear credible," Allure Security said.