Bank of America

Banking United Statesbankofamerica.comRank 19 of the most impersonated
Cert findings · 24 h
1
Cert findings · 7 days
3
2 on phishing hosts · 1 on Spamhaus DROP
Registered lookalikes
183
8 listed by a source or an address list
Official domains
43
verified from Bank of America's own sites and records

Certificate findings for Bank of America

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Bank of America's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 4 findings, grouped by hostname

  1. bankofamericabank.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 21 y ago
    DetailsHide
    Hostname
    bankofamericabank.com
    First seen
    2026-11-05 08:59 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.53.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.162.80.53
    Brand
    Bank of America
    Addresses
    69.162.80.53 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    212.7.194.68 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    bankofamericabank.com
    Registered
    2005-10-20 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  2. bankofamerica.sberbankmobile.ru RU · AS49063 · DTLN Data Storage Center JSC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    bankofamerica.sberbankmobile.ru
    First seen
    2026-11-02 10:11 UTC
    First published
    2026-11-02 10:48 UTC
    DNS
    Resolves · checked 2026-11-04 11:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.242.79.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 87.242.79.60
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 09:06 UTC to 2027-01-31 09:06 UTC
    Logged 2026-11-02 10:05 UTC in Google ParcelYard2027h1, entry 569,880,681
    SHA-256 38705aee7735da179017ae246310391d1a02fef13ac2be5fd0356809a6003d47
    Public key SHA-256 3e8b7edffb92f3a556cc7f3ae30edefa7b27212bb67b401f4ecf91c1c50e558c
    Brands
    Bank of America, Sberbank
    Addresses
    87.242.79.60 · Russia · AS49063 DTLN Data Storage Center JSC
    Domain
    sberbankmobile.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  3. 963-bofa-webacce-auth.com SC · AS197170 · TECHTIES-AS TechTies Inc.
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    963-bofa-webacce-auth.com
    First seen
    2026-10-29 17:05 UTC
    First published
    2026-10-29 17:26 UTC
    DNS
    Not resolving since 2026-11-01 · checked 2026-11-04 17:33 UTC
    Checks
    Overdue since 2026-11-01 17:32 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 176.65.132.55.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 176.65.132.55
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-29 16:01 UTC to 2027-01-27 16:01 UTC
    Logged 2026-10-29 17:00 UTC in Geomys Tuscolo2027h1, entry 397,254,169
    SHA-256 8259eddd64d0a3262f501b4f2c2c397cc128b86ab2388885acd4e5cd648430af
    Public key SHA-256 5870d4c19e76df913bdb315de41982e3b52c41d48ff13ed24bda72f64eeefaae
    Brand
    Bank of America
    Addresses
    176.65.132.55 · Seychelles · AS197170 TECHTIES-AS TechTies Inc.
    Domain
    963-bofa-webacce-auth.com
    Registered
    2026-10-29 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  4. nodemate.ggather.com US · AS14061 · DigitalOcean, LLC
    ReportedDigitalOceanReported by PhishTank as imitating Bank of America CorporationMX presentSPF -allDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    nodemate.ggather.com
    First seen
    2026-10-26 07:26 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-05 00:26 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Let's Encrypt Willow2027h1, entry 778,048,126
    SHA-256 98765c7c159503ff9440bcbb44d8aa30c30c8e133d2c0ce5d365414509ed41ef
    PhishTank
    PhishTank report #8088989
    Brand
    Bank of America
    Addresses
    146.190.244.226 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (146.190.244.226): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ggather.com
    Registered
    2016-04-07 · Cloudflare, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:24 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Bank of America when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Banking

All brands →