bankofamerica-security[.]blogspot[.]com

Analysis of bankofamerica-security.blogspot.com indicates active use in a banking‑phishing campaign. The domain is hosted on the Google Blogger platform, as reflected in the registration data, which suggests the adversary leveraged a free‑hosting service to obtain a seemingly legitimate subdomain. VirusTotal reports that 20 of 91 scanning engines have flagged the domain, providing independent corroboration of malicious intent. Independent anti‑phishing feeds have already added the domain to their blocklists; both PhishDestroy and Phishunt list it as blocked, and it appears on two additional security blocklists used by network defense products.

No public information is available regarding the underlying IP address, SSL certificate details, HTTP response codes, or page title, limiting the ability to assess the site’s technical fingerprint beyond its hosting provider. Consequently, the precise payload or credential‑capture mechanism remains unknown. Defenders should ensure that DNS‑ or URL‑filtering solutions incorporate the domain in their deny lists, and that browser security extensions subscribed to PhishDestroy and Phishunt are up‑to‑date.

Continuous monitoring of Google Blogger subdomains for sudden appearance of banking‑related keywords is advised, as is the deployment of heuristic detection that flags domains containing “bankofamerica” combined with “security” in the subdomain. Incident response teams should treat any login attempts or credential submissions to this domain as compromised and instruct users to change affected passwords immediately. Ongoing intelligence collection is recommended to capture any future infrastructure changes, such as migration to dedicated hosting or the appearance of SSL certificates, which would warrant reassessment of the threat level.