An exact search for the phrase “one of the largest digital banking providers” in the source code of publicly available websites flagged approximately 2,200 domains. We investigated each one. Of the sites that still carried the phrase, 97% retained artifacts from Cuex, a commercially available template designed for currency exchange and money transfer websites. It cost $25 at the time of our research. That inexpensive visual layer had been adapted into applications with login and registration forms, investment and transfer language, account dashboards, and other bank-like functions. We call this layered approach legitimacy stacking. Those capabilities work alongside corporate details, compliance claims, and support channels to make an invented institution appear credible. The resulting financial front can provide a convincing pretext for investment, loan, romance, recovery, and advance-fee fraud. One sentence exposed the collection of domains. Deeper investigation and campaign mapping surfaced code, assets, form destinations, identifiers, and public records that ultimately showed how its pieces were connected.
One odd sentence
The investigation began with a support ticket.
Molly DeQuattro, Allure Security’s VP of Operations, was reviewing an alert on a suspicious domain name resembling the brand of one of our financial services clients. The domain was suspicious, but the page did not contain the client’s logo, language, or other branding. It presented an apparently unrelated bank.
One sentence on the site caught Molly’s attention: “one of the largest digital banking providers.” The wording felt awkward and generic enough to prompt a closer look. She searched public website source code for the exact phrase, and received roughly 2,200 matching domains in return.
What initially looked like a one-off support case had become a much larger investigation. The research team decided to pursue the lead and our engineering team submitted the data set to our systems for comprehensive analysis.
The first site raised the question that drove the investigation: Why would someone place an invented bank on a domain associated with another brand? A victim would not confuse it with their existing bank. This was not straightforward brand impersonation. The answer required us to look beyond the default pages and examine what the applications could do, what their developers had left behind, and where those remnants led.
The template was only the surface
We attempted to connect to all 2,200 domains under a uniform collection method. Of those, 1,095 returned a webpage successfully, recorded as an HTTP 200 “OK” response. The exact phrase remained on 838 sites. Another 257 returned a page but had removed or modified the reference. The remaining 1,105 did not return a successful page response during our collection period.
- 810 (97%) retained artifacts derived from a Cuex template
- 790 (94%) showed signs of Laravel, a PHP framework used to build web applications
- 756 (90%) still displayed the misspelled templated heading
Curreny Charts - 779 (93%) fell into the dominant cluster when the signals were combined
Cuex is a commercially available front-end template for currency exchange, money transfer, loans, and digital-banking websites. It supplied much of the visible design. At the time of review, a regular license cost $25. Its current public demo still contains the Curreny Charts typo, but of special note it does not contain our search sentence or the Laravel application behavior tracked across our data set.
Laravel is a PHP framework used to build server-side web applications. In this family, it appears to supply much of the machinery behind the design: sessions, routes, form handling, registration, and account access. The evidence points to a downstream adaptation that joined the Cuex front end to a reusable application layer.
We found comments in the source code that made reuse especially clear. Developers had left notes such as matches Site A and Applies to all sections from Site B inside code served under otherwise unrelated brands. The same page retained a comment from HTTrack, a website-copying program, naming the source of the mirror. Together, these indicators document an iterative copy-and-adapt workflow that went beyond installing an untouched copy of Cuex.
That lineage matters, but it has limited attribution value. Shared code can result from a common developer or operator, an application-kit seller or reseller, a shared deployment workflow, or some combination of them. Our data supports a common implementation family across most surviving sites. It does not identify a single entity responsible for the entire collection or implicate the Cuex seller or the Laravel project.
These phantom banks were more than just facades
Cuex supplied the visible design. Of the 838 sites that still carried the phrase, 770 presented login pages, 767 set session cookies, and 729 contained references to anti-forgery tokens. These are common components of web applications that accept user input and maintain sessions. Their prevalence shows that most sites in the family paired the reused front end with a stateful application layer.
On top of that application layer, the sites stacked features and claims associated with a full-service financial institution:
These categories overlap. Public-text counts describe the financial story presented to visitors, including material inherited from reused template content. Links and routes show navigation or form targets present in the saved public HTML.
One deployment offered a deeper view. Its public login source exposed a Laravel Ziggy map containing 59 named routes. Ziggy makes server route names available to front-end JavaScript. The map described functions for customer search and administration, know your customer (KYC) review, transaction management, customer email, cards and wallets, deposits, transfers, PIN and one-time password (OTP) prompts, registration, password resets, and account verification. We did not request those routes or attempt any of the underlying functions. The map shows what the application was designed to support, not which features were ultimately accessible or verified operational.
Taken together, the features observed across these discovered phantom-financial sites fit a familiar fraud model. A broker, romantic contact, loan agent, recovery service, or supposed delivery representative can introduce a victim to an unfamiliar financial institution. The portal gives that story a persistent interface for accounts, balances, investment gains, transfers, holds, and withdrawal problems. Verification requirements, taxes, compliance charges, and release fees can then provide reasons for delays and additional demands.
The legitimacy stack had several layers. Banking interfaces, investment products, KYC flows, corporate identities, regulatory or insurance claims, and customer-support channels each reinforce the credibility of an invented institution. We intentionally limited our research to public pages, source code, and public records. We did not submit forms, attempt logins, collect victim conversations, or document a completed financial loss. This fraud model is supported by the observed features and prior reporting on fictitious banks and investment platforms.
An OpSec lapse exposed an outside connection
Create an Account- Remedy bank. The page source also retained Remedy names and asset paths. The most consequential leftover appeared in the registration form. It was configured to send completed submissions to https://remedycodes[.]site/register The form asked for identity and contact information, an account type, a PIN, a password, and other registration data. We did not submit it. The source nevertheless showed where a completed form was intended to go.
That destination opened a second line of research. The same Remedy domain appeared as contact information on sites not included in our data set but were reported elsewhere as fraudulent. Artists Against 419, a long-running volunteer anti-fraud project, documented support@remedycodes[.]site for Flipbridge Assets, which it categorized as loan and investment fraud. Separately, TraderKnows’ review of Thefundtrd gave the platform a “Suspected Fraud” status and identified the same out-of-domain Remedy address as its only contact. The review also cited unsupported regulatory claims, copied company details, and a fabricated management team. We found no evidence directly linking Flipbridge Assets and Thefundtrd beyond their use of the same Remedy contact address.
On August 6, 2026, the authoritative .site RDAP service identified remedycodes[.]site as available for registration. At validation time, the Classtands form pointed to an unregistered destination. The stale form action preserved evidence of its connection to Remedy after the destination had disappeared.
This does not prove that the endpoint received data from the Classtands Crest site, and the shared domain does not establish who operated the sites. Even with those limits, the evidence goes beyond visual resemblance. The copied application pointed to a Remedy domain that also appeared as contact information on two investment sites independently flagged by outside researchers for fraud or suspected fraud. Leftover branding and the stale form destination preserved a traceable connection to Remedy.
Public records closed more of the gap
Other domains supplied different forms of corroboration.
Cap Rock came back. Artists Against 419 reported caprocktb[.]com as a fake bank in June 2024. The domain later disappeared, was registered again in May 2026, and returned with the Cuex-derived design and technical traces of Laravel seen across the dominant application family in our data set. The revived site reused the Charlottesville address displayed by its earlier version and presented a public email-and-password login form. We describe this as phantom-bank resurrection: the invented institution’s name and public story survived a break in the domain’s registration history.
Upward Saver’s company number belonged elsewhere. The live site at upwardsaverbc[.]com claimed UK company number 07325299. Companies House records for that number identified CDC Solutions Ltd, a different company that was dissolved in 2012. An earlier site at upwardsaverbc[.]cchad used the same Upward Saver Bank Corporation name and phone number, +44 770 142 3168. The repeated identity shows that the same invented bank was reused across domains, although it does not establish who operated them.
One phone number crossed ten live sites. The number +2349150599242 appeared on ten phrase-matching domains. Public reporting connected the same number to ksmbc-bank[.]live, which Artists Against 419 listed as a fake bank. The number is a useful deployment link. Its Nigerian country code does not identify an operator’s identity, nationality, or physical location.
FDIC claims failed a basic record check. Twelve sites claimed FDIC protection. Unsurprisingly, none of the domains appeared in the FDIC’s BankFind Suite, which can be searched by institution name or website. Eleven displayed institution names were absent. A search for the generic name “United Bank” returned real institutions with no connection to bnkunited[.]com. BankFind did not support the claims.
What this research adds
Fictitious banks are a documented fraud tool. GoSecure’s 2022 Operation Bankroll described fake financial institutions used in investment scams and possible Ponzi schemes. Group-IB has documented how fake investment platforms display fabricated returns, control withdrawals, and use shared technical infrastructure.
Our contribution is a complete, phrase-led data set of 2,200 domains tested with one collection method. We measured application behavior across every surviving page containing the phrase, clustered the family using text, assets, structure, cookies, form targets, and identifiers, and then added public reports and official records as independent anchors. The result supports a mass-produced phantom-finance ecosystem containing several technical and deployment clusters. It does not establish a single actor responsible for all 2,200 domains.
The sentence is already losing coverage
The copied sentence led us to the collection, but it will not track the family forever.
Among the 257 pages that successfully returned HTTP 200 without the phrase, most had become parked domains, access gates, suspension notices, expired-domain pages, or hosting debris. Sixteen still presented financial or trading content. Fourteen of those retained at least one technical connection to the phrase cluster, and ten had a moderate or strong connection. Some had simply replaced the sentence with language such as “your digital banking partner.”
Text is easy to edit. Exact assets, normalized page structure, session-cookie defaults, chat identifiers, source comments, and cross-domain form targets tend to survive longer. The phrase remains an effective discovery seed. The recurring combination of Cuex-derived assets, Laravel conventions, and higher-specificity indicators provides a more durable way to track the application family.
What defenders can do this week
Phantom banks can support fraud in both workplace and personal settings. An employee might receive a link as supposed proof of a payment or account. An individual might be directed to one during an investment, loan, romance, recovery, or advance-fee scheme. In either setting, the portal can help manufacture trust by making an invented financial claim appear independently verifiable. Defenders therefore have two practical goals: help people recognize the warning signs and identify the infrastructure supporting the story.
Treat the 2,200 search results as investigative leads rather than a ready-made blocklist. Brand-protection, fraud, threat-intelligence, and security teams can:
- Teach employees and customer-facing teams to verify unfamiliar financial institutions through contact details obtained independently of the conversation or website.
- Start with the exact phrase, the Curreny Charts typo, and distinctive Cuex-derived paths. Treat those as discovery leads, then add higher-confidence signals.
- Hash public JavaScript, CSS, and images and compare exact matches.
- Normalize page and form structure so brand-name changes do not break clustering.
- Record session-cookie names, chat-widget accounts, email addresses, phone numbers, and cross-domain form destinations.
- Give the greatest weight to combinations of independent, uncommon indicators.
- Check claimed companies, regulators, deposit insurance, and public fraud reports when assessing a domain.
- Preserve the page, timestamp, response status, hash, and source supporting each conclusion.
Keep collection passive. We did not submit forms, create accounts, test credentials, request protected routes, register abandoned dependencies, or bypass access controls. A template match or shared hosting provider is context, not a verdict.
The technical paper that follows this post will publish the fuller indicator matrix, feature inventory, clustering methodology, timelines, route and form measurements, and documented limitations. The central lesson is already clear. A copied sentence can surface a large set of sites. Understanding how those sites relate requires following the application and tracing the legitimacy stack behind it. Bank-like functions, compliance claims, corporate identities, and support infrastructure work together to make an invented institution appear credible.
Allure Security Protection and Mitigation
Allure Security brand and domain protection customers have coverage against this threat through automated monitoring of organic search for malicious results related to their brand and relevant terms.
