A single phrase in a suspicious website’s source code led researchers at Allure Security to roughly 2,200 domains built to host invented financial institutions. A search for the exact wording, “one of the largest digital banking providers,” turned up the cluster, of which 1,095 returned a working page and 838 still carried the phrase.
Nearly all of them share a common foundation. About 810 of the 838, or 97 percent, are assembled from Cuex, a $25 template meant for currency-exchange and digital-banking startups. Laravel, the PHP framework handling logins, sessions, and registration, appeared on 94 percent, and a misspelled template heading, “Curreny Charts,” on 90 percent. The researchers call the pattern legitimacy stacking: banking interfaces, dashboards, investment products, corporate details, and support contacts layered together so a fake institution looks credible.
The scale of the fraud infrastructure is striking. Among the 838 sites, 770 presented login pages, 767 set session cookies, and 729 included anti-forgery tokens, the building blocks of applications built to accept and hold user data. One site, branded Classtands Crest, leaked its origins when its account-creation page was still titled “Create an Account- Remedy bank,” and its registration form sent submitted data to remedycodes[.]site, a contact point already flagged on two other suspected fraud sites.
The model is familiar: a broker, romantic contact, loan agent, or delivery representative introduces a victim to an unfamiliar institution, and the portal supplies a persistent interface for accounts, balances, and withdrawal problems. Allure recommends checking for the “Curreny Charts” typo, shared paths and code, matching cookies, and forms that post to the same destination, and verifying institutions independently before trusting them.
