Canadian bank "2FA" and "secure" look-alike domains (TD, RBC, CIBC, BMO, Scotiabank, Desjardins) behind a slider-puzzle gate

Phishing domains that impersonate Canadian banks and payment services (TD, RBC, CIBC, BMO, Scotiabank, Desjardins AccèsD, Tangerine, Simplii, ATB, Vancity, Interac, Canada Post and SAAQ), named for a security, PIN-reset or two-factor step. Examples: td2fasecure[.]com, cibc2fasecure[.]com, rbc2fasecure[.]com, bmosecure2fa[.]com, cibc-pin-reset[.]com, accesd-securite-web[.]com, saaqclic-royalbank[.]com, tdsecureonlineportal[.]com, cibcresolutions[.]com, scotiabank2fadevice[.]com, securerbcdevice2fa[.]com and simplii2fa[.]com. The operator registers them in bulk, often weeks before use, all on the same DNS provider, and points them at a few rented servers that change every few days. The site root answers with an empty web-server 404 and the lure sits on a per-victim link, typically sent by text message; some of the servers refuse visitors from outside the target country. One captured page put a slider puzzle and a proof-of-work browser check ("Verify you're human") in front of the lure. A match means a page carrying that gate code, or a scan of the domains or server addresses in the search anchor.