Bank "help desk" look-alike domains behind an operator-approval gate

Phishing campaign, active since at least February 2026, that registers look-alike support domains for banks and business-banking portals: the bank or portal name followed by helpdesk, helpchat, gethelp, getsupport, livesupport, supportchat or supportdesk, for example hsbcnethelpdesk[.]com, cashprolivehelpdesk[.]com or jpmorganaccesshelpchat[.]com. Names seen so far imitate J.P. Morgan Access, Chase Connect, Bank of America CashPro, HSBCnet, Barclays iPortal, Westpac, ANZ, ASB, NAB Connect, CommBank CommBiz, Santander, Wells Fargo, Truist, Airwallex and MUFG, among others. The sites are built to be opened while someone talks the victim through it. An automated visitor gets a plain "Scheduled Maintenance" page. A browser gets a Cloudflare Turnstile check and then a "Verifying Your Session" screen that records the visitor's public IP address (through a WebRTC STUN request) and waits until a human operator approves or rejects the session; only an approved visitor is sent on, and a rejected one is sent to Google. A second variant on the same campaign's domains runs a proof-of-work check and then a page runtime that displays whatever page the operator pushes to it over a WebSocket. Domains are registered a few at a time and are short-lived; many were suspended within days. A match means a page carrying either gate, or a scan of a known campaign server or domain.