URLQuery
2 det.
Open reportPhishDestroy stores a record for boc.hkbankserv.com. Source observations are dated separately; missing checks do not establish safety.
“中國銀行(香港)有限公司”
The sent-report ledger records the first outgoing report at . The recorded recipient is abuse@dynadot.com. The latest stored availability evidence still shows the domain reachable; 19 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
PhishDestroy analysis, earlier unreviewed version
PhishDestroy’s intake AI recorded a phishing assessment for boc.hkbankserv.com on 2026-10-23, citing a 90% confidence that the page impersonates Bank of China (Hong Kong). The recorded page title was "中國銀行(香港)有限公司", matching the official brand while the domain differs from the legitimate bochk.com address. An HTTP request on the same day returned a 200 status code, confirming the page was reachable at that time.
In brand‑impersonation phishing, attackers host a replica of a financial institution’s site on an unrelated domain, copy logos and wording, and lure users to submit login credentials or personal data. Harvested credentials can be used to access real accounts or sold on underground markets.
VirusTotal scanned the domain on 2026-10-23 with 92 engines and reported zero detections and zero suspicious findings. Google Safe Browsing checked the URL on 2026-10-23 and did not flag it. urlscan.io analyzed the page on 2026-10-23 and assigned a malicious score of 100, categorising it as phishing and linking it to the Bank of China brand. PhishDestroy’s internal blocklist marked the domain as malicious, while external blocklists returned no hits and OTX listed zero pulses.
The domain was created 32 days before the first sighting and used a Let’s Encrypt TLS certificate issued on 2026-09-20, valid until 2026-12-19. The domain resolved to 144.172.85.35 at the time of observation, which was assigned to RouterHosting LLC in Singapore. The server header identified nginx, and ports 22, 80 and 443 were observed as open.
Visitors should not enter any Bank of China (Hong Kong) credentials on this site; if they have, they should change passwords with the legitimate bank and monitor accounts for unauthorised activity. Security teams should block boc.hkbankserv.com, add it to phishing detection rules, and review logs for any connections to the recorded IP address. No wallet‑related actions are required because wallet recommendations are disabled for this domain.
2 det.
Open reportMalicious
SHA-256 a43e3a303c5bbf25d4133b1c66896f253f6765835cae797df43b6baf6547c03c
Observed: · Retrieved:
| Uuid | 01a1671e-31aa-749c-8b0b-e58953389d50 |
|---|---|
| Final url | https://boc.hkbankserv.com/ |
| Status | 200 |
| Ip | 144.172.85.35 |
| Contacted domains | [
"www.bochk.com",
"snap.licdn.com",
"px.ads.linkedin.com",
"cdn.chatway.app"
] |
| Contacted IP addresses | [
"202.127.170.52",
"172.64.146.215",
"2.21.20.143",
"144.172.85.35"
] |
| Asns | [
"24396",
"13335",
"20940",
"14956"
] |
| Countries | [
"HK",
"DE",
"SG"
] |
| Linked domains | [
"www.bochk.com"
] |
| Document hash | 4e487d557e3be6690f12d13df150f945c82350e37dc031e3ebed27aa7a9b26c8 |
| Script hashes | [
"8028beb041fb41956e80af9982bc9b113ab059a9882eb50f6d1e048d84182379",
"da06647b88a66fb8e0385816c398d746b1262f882a14e293834ca7eb928b940a",
"a84cb702fb991628b50583f252c01b53f1f6dec1ce87fa59ac3efabb7c3419cc",
"c4a8b3557758476503848e86bd07819627b7fe53112bf51a06e06552787dcc56",
"6fe9965e6af5fd5bcb5a883f3641b0aee0cfca92cda370ad7f2d7f986657c612",
"660397bc22eaee467ffcb448e77fe0c3a1d72e35a73a646a3dd9be4f3fab2fdf",
"634fbaf2b3678a5865bed5e7a85e32ff52b07bd2e5da5bb9f776ab25d83f4de8",
"d7a1aacaff128cba603b8155100f1a575d6bac36b140ee5c481cc4e196131ce9",
"a0fe8a1bce540943451e192de4545e4bd84313412a0855b99e89920b9d86c989",
"22f283a0a93273bbba9681875e02ac191516cb9738d2ba914d6536e255d1c1dc"
] |
| Globals | [
"startTime",
"detectMobile",
"_wcm_vlc",
"_wcm_ct",
"_wcm_cp",
"_wcm_cd",
"_wcm_cu",
"_wcm_cuj",
"_wcm_ce",
"_wcm_c",
"_wcm_co",
"_wcm_d",
"_wcm_vo",
"_wcm_do",
"_wcm_epv",
"_wcm_pa",
"_wcm_to",
"_wcm_i",
"_wcm_w",
"_wcm_performLinkClick",
"callSensor",
"_wcm_eventCapture",
"_wcm_captureLink",
"_wcm_captureLinkArea",
"_wcm_isMobileLink",
"_wcm_captureVideo",
"_wcm_det_link_type",
"_wcm_syncFinishAjax",
"_wcm_asyncFinishAjax",
"_wcm_linkCapture",
"determineLinkTitle",
"_wcm_isLinkWithImg",
"$",
"jQuery",
"sendRequest",
"formDataToJSONString",
"formElemToJSON",
"addJSONRecord",
"QR8bitByte",
"QRCode"
] |
| Cookies | [
"FontSize",
"bcookie",
"li_gc",
"lidc",
"__cf_bm"
] |
| Storage keys | [
"li_adsId"
] |
| Tls | {
"san": [
"boc.hkbankserv.com"
],
"cipher": "AES_256_GCM",
"issuer": "YR1",
"subject": "boc.hkbankserv.com",
"protocol": "TLS 1.3",
"valid_to": "2026-12-19T18:23:21Z",
"valid_from": "2026-09-20T18:23:22Z"
} |
| Domain age days | 32 |
| Apex age days | 32 |
| Tls age days | 32 |
| Tls valid days | 89 |
| Requests | 88 |
| Provider verdicts | {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
],
"score": 93,
"malicious": true
},
"overall": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"bankofchina"
],
"malicious": true,
"categories": [
"phishing"
]
},
"urlscan": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"Bank of China"
],
"malicious": true,
"categories": [
"phishing"
]
}
} |
| HTTP headers | {
"server": "nginx",
"content-type": "text/html",
"x-frame-options": "SAMEORIGIN",
"x-content-type-options": "nosniff",
"referrer-policy": "same-origin"
} |
Separate stored monitor snapshot; does not replace the primary report record or establish current availability.
0 / 92 engine detections
Observed: · Retrieved:
| Vendor result counts | {
"timeout": 0,
"harmless": 55,
"malicious": 0,
"suspicious": 0,
"undetected": 37
} |
|---|---|
| Reputation | 0 |
| Registrar | Dynadot Inc |
| Created | 2026-09-20T17:14:32Z |
| Expires | 2027-09-20T17:14:32Z |
| Updated | 2026-09-20T17:15:11Z |
| First seen | 2026-09-20T19:46:14Z |
| DNS records | [
{
"ttl": 300,
"type": "A",
"value": "144.172.85.35"
}
] |
| Dns at | 2026-10-23T05:55:13Z |
| Jarm | 2ad2ad16d2ad2ad00042d42d000000df133019600a83abfb096ff3e86cd79d |
| Certificate | {
"san": [
"boc.hkbankserv.com"
],
"issuer": "Let's Encrypt / YR1",
"serial": "5fd077091d7191b142d4f9f37a89c439662",
"sha256": "49abbc75db2b26c18739e020e90e0cb6b7fa76704bd518c51b8807c38d094196",
"subject": "boc.hkbankserv.com",
"valid_to": "2026-12-19T18:23:21Z",
"valid_from": "2026-09-20T18:23:22Z"
} |
| Registration record | {
"registrar": "Dynadot Inc",
"registrar_iana_id": "472",
"registrar_url": "http://www.dynadot.com",
"created": "2026-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"expires": "2027-09-20T17:14:32Z",
"status": [
"clientTransferProhibited"
],
"nameservers": [
"ns1.dyna-ns.net",
"ns2.dyna-ns.net"
],
"dnssec": "unsigned"
} |
This is a separate stored result. Its counts, vendors and dates do not replace the provider observation above. A retrieval date is not an analysis date.
no community references
Open reportprovider verdict: clean
Open reportObserved: · Retrieved:
| Uuid | c9fdea2a-f518-4b2e-be14-293ab6930e4e |
|---|---|
| Final url | https://boc.hkbankserv.com/ |
| Status | 200 |
| History | [
{
"url": "https://boc.hkbankserv.com/",
"status": 200
}
] |
| DOM structure hash | c49478b0179e6d4dc9baebb3aba0c65634fee3c6b6f8553ab81db945715c5ddc |
| Document hash | 4e487d557e3be6690f12d13df150f945c82350e37dc031e3ebed27aa7a9b26c8 |
| Radar rank | {
"bucket": ">200000"
} |
| DNS records | [
{
"name": "boc.hkbankserv.com",
"type": "A",
"value": "144.172.85.35"
}
] |
| Dnssec valid | false |
| Ip | 144.172.85.35 |
| Registration record | {
"registrar": "Dynadot Inc",
"created": "2026-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"expires": "2027-09-20T17:14:32Z",
"nameservers": [
"ns1.dyna-ns.net",
"ns2.dyna-ns.net"
]
} |
No threat flag
Open reportCheck recorded; verdict not retained
Open report10 / 100 · heuristic score · 4 brand references · 1 classification
Open reportThis dated monitor analysis is separate from the primary PhishDestroy analysis above. A heuristic score is not a measured probability.
Narrative generation metadata
Open reportThe narrative generation date is separate from observation dates. These are the retained publication fields, not an additional independent detection.
Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
Stored page, network and scanner observations, grouped by source and observation time.
| Caa records | {
"domain": "boc.hkbankserv.com"
} |
|---|---|
| Protective DNS results | {
"resolvers": 12,
"blocked_count": 0
} |
| Web archive observations | {
"last": "2026-10-23T04:58:25Z",
"first": "2026-10-23T04:58:25Z",
"changes": 0,
"days_archived": 1,
"avg_page_bytes": 29845
} |
| Page title and metadata | {
"ogUrl": "https://boc.hkbankserv.com/",
"title": "中國銀行(香港)有限公司",
"ogType": "website",
"ogImage": "http://boc.hkbankserv.com/files/whatsapp.png",
"ogTitle": "中銀香港",
"ogDescription": "中銀香港為您提供創新、專業及全面的金融服務,助您創富增值,致力成為您的最佳銀行。"
} |
| Trackers | {
"requests": 90,
"trackers": [
{
"name": "LinkedIn Ads",
"company": "Microsoft",
"country": "US",
"category": "Advertising",
"requests": 2
},
{
"name": "Cloudflare",
"company": "Cloudflare",
"country": "US",
"category": "Hosting",
"requests": 1
},
{
"name": "LinkedIn Analytics",
"company": "Microsoft",
"country": "US",
"category": "Site Analytics",
"requests": 2
}
]
} |
| Forms and mixed content | {
"no_sri": [
"https://cdn.chatway.app/widget.js"
],
"third_party_scripts": 1
} |
| Status | {
"up": true,
"code": 200,
"timings": {
"dns": 188,
"tls": 254,
"wait": 219,
"connect": 201,
"download": 796
},
"response_ms": 1658
} |
| TLS connection | {
"alpn": "h2",
"cipher": "TLS_AES_256_GCM_SHA384",
"protocol": "TLSv1.3",
"versions": [
"TLSv1.2",
"TLSv1.3"
],
"authorized": true,
"forward_secrecy": true
} |
| Ports | {
"open": [
22,
80,
443
]
} |
| Carbon | {
"bytes": 236747,
"co2_grams": 0.0087,
"cleaner_than": 3
} |
| Dns server | {
"ns": [
{
"ip": "162.159.25.5",
"host": "ns2.dyna-ns.net"
},
{
"ip": "162.159.27.158",
"host": "ns1.dyna-ns.net"
}
],
"zone": "hkbankserv.com"
} |
| Cookies | {
"cookies": [
{
"name": "FontSize"
},
{
"name": "bcookie",
"secure": true,
"same_site": "None"
},
{
"name": "li_gc",
"secure": true,
"same_site": "None"
},
{
"name": "lidc",
"secure": true,
"same_site": "None"
},
{
"name": "__cf_bm",
"secure": true,
"http_only": true,
"same_site": "None"
}
]
} |
| Location | {
"ip": "144.172.85.35",
"asn": "14956",
"org": "RouterHosting LLC",
"city": "Singapore",
"country": "SG"
} |
| Ssl | {
"issuer": "Let's Encrypt / YR1",
"subject": "boc.hkbankserv.com"
} |
| DNS records | {
"A": [
"144.172.85.35"
]
} |
| Dnssec | {
"ds": false,
"rrsig": false,
"dnskey": false
} |
| Hsts | {
"message": "Site does not serve any HSTS headers."
} |
| HTTP security policies | {
"xFrameOptions": "SAMEORIGIN",
"referrerPolicy": "same-origin",
"xXSSProtection": "1; mode=block",
"permissionsPolicy": false,
"xContentTypeOptions": "nosniff",
"contentSecurityPolicy": false,
"strictTransportPolicy": false,
"crossOriginOpenerPolicy": false,
"crossOriginEmbedderPolicy": false,
"crossOriginResourcePolicy": false
} |
| Get ip | {
"ip": "144.172.85.35",
"family": 4
} |
| Redirects | {
"chain": [
"https://boc.hkbankserv.com"
]
} |
| Page links | {
"external": [
"https://www.bochk.com/tc/home.html",
"https://www.bochk.com/tc/home.html",
"https://www.bochk.com/dam/wm/family-wealth-management/offer_tc.html",
"https://www.bochk.com/tc/creditcard/cip/ci.html",
"https://www.bochk.com/tc/home.html",
"https://www.bochk.com/tc/corporate.html",
"https://www.bochk.com/tc/corporate/casestudies.html",
"https://www.bochk.com/tc/corporate/commbanking.html",
"https://www.bochk.com/tc/corporate/ecomm.html",
"https://www.bochk.com/tc/corporate/cashmgt.html",
"https://www.bochk.com/tc/corporate/treasury.html",
"https://www.bochk.com/tc/corporate/card.html",
"https://www.bochk.com/dam/smeinone/crossborderbusinessfinancialsolutions/tc.html",
"https://www.bochk.com/tc/pw.html",
"https://www.bochk.com/tc/wm.html",
"https://www.bochk.com/tc/enrich.html",
"https://www.bochk.com/tc/enrich/offer.html",
"https://www.bochk.com/tc/enrich/tailoredinfo.html",
"https://www.bochk.com/tc/enrich/servicetype.html",
"https://www.bochk.com/tc/enrich/econanalysis.html",
"https://www.bochk.com/tc/ifree.html",
"https://www.bochk.com/tc/ifree/promotion.html",
"https://www.bochk.com/tc/ifree/parentsandchildren.html",
"https://www.bochk.com/tc/ifree/smartelderly.html",
"https://www.bochk.com/tc/ifree/student.html"
],
"external_count": 480,
"internal_count": 1
} |
| Registration record | {
"registrar": "Dynadot Inc",
"created": "2026-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"expires": "2027-09-20T17:14:32Z",
"status": [
"clientTransferProhibited https://icann.org/epp"
],
"nameservers": [
"ns1.dyna-ns.net",
"ns2.dyna-ns.net"
]
} |
| HTTP headers | {
"headers": {
"server": "nginx",
"content-type": "text/html",
"x-frame-options": "SAMEORIGIN",
"x-content-type-options": "nosniff",
"referrer-policy": "same-origin"
}
} |
Checked, no match
Last checked
ns1.dyna-ns.netns2.dyna-ns.netLocation describes the IP network.
49abbc75db2b26c18739e020e90e0cb6b7fa76704bd518c51b8807c38d094196boc.hkbankserv.comSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
The domain no longer resolves in DNS.
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
Google PageSpeed Insights — mobile performance audit of boc.hkbankserv.com ·
Timestamped response metadata retained by the local collection pipeline. Each value below belongs to the displayed archive time.
https://boc.hkbankserv.com/Server: nginxContent-Type: text/htmlContent-Encoding: gzip8dd2451e41db10e438ae7708bae0b0090fa350da66e7a46571293427311268efh3=":443"; ma=86400keep-alivegziptext/htmlFri, 23 Oct 2026 04:58:13 GMTW/"6ab0a232-39ccb"Mon, 21 Sep 2026 03:19:14 GMTsame-originnginxchunkedAccept-EncodingnosniffSAMEORIGINmaster-only1; mode=blockValues retained by the collector; long values may be shortened during collection.
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
{
"ip": "144.172.85.35",
"asn": "AS14956",
"city": "Singapore",
"score": 100,
"title": "中國銀行(香港)有限公司",
"brands": [
"bankofchina"
],
"server": "nginx",
"country": "SG",
"asn_name": "ROUTERHOSTING - RouterHosting LLC, US",
"malicious": true,
"categories": [
"phishing"
],
"tls_issuer": "YR1",
"captured_at": "2026-10-23 04:56:44.567000",
"payload_hash": "a43e3a303c5bbf25d4133b1c66896f253f6765835cae797df43b6baf6547c03c",
"target_brand": "bankofchina",
"technologies": [
"Adobe Experience Manager",
"Cloudflare Bot Management",
"Linkedin Insight Tag"
]
}{
"dns_rcode": "NXDOMAIN",
"observed_at": "2026-11-11 11:22:06.505162",
"latest_http_observation": {
"cause": "probe_inconclusive",
"state": "unknown",
"source": "http_observation",
"mechanism": null,
"actor_name": null,
"actor_type": "unknown",
"confidence": 20,
"observed_at_utc": "2026-11-11 23:54:11",
"availability_state": "unreachable",
"provider_action_verified": false
}
}{
"cf": {
"v": 1,
"ip": "144.172.85.35",
"dns": [
{
"name": "boc.hkbankserv.com",
"type": "A",
"value": "144.172.85.35"
}
],
"uuid": "c9fdea2a-f518-4b2e-be14-293ab6930e4e",
"whois": {
"created": "2026-09-20T17:14:32Z",
"expires": "2027-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"registrar": "Dynadot Inc",
"nameservers": [
"ns1.dyna-ns.net",
"ns2.dyna-ns.net"
]
},
"status": 200,
"history": [
{
"url": "https://boc.hkbankserv.com/",
"status": 200
}
],
"doc_hash": "4e487d557e3be6690f12d13df150f945c82350e37dc031e3ebed27aa7a9b26c8",
"dom_hash": "c49478b0179e6d4dc9baebb3aba0c65634fee3c6b6f8553ab81db945715c5ddc",
"final_url": "https://boc.hkbankserv.com/",
"fetched_at": "2026-10-23T05:39:47Z",
"radar_rank": {
"bucket": ">200000"
},
"scanned_at": "2026-10-23T05:33:39Z",
"dnssec_valid": false
},
"og": {
"k": "boc-hkbankserv-com-security-report.png",
"v": "f13f985064d5",
"at": "2026-10-27T03:22:47Z",
"alt": "boc.hkbankserv.com: caution — 5/92 VirusTotal engines. PhishDestroy risk score 85/100 (critical)."
},
"vt": {
"v": 1,
"dns": [
{
"ttl": 300,
"type": "A",
"value": "144.172.85.35"
}
],
"cert": {
"san": [
"boc.hkbankserv.com"
],
"issuer": "Let's Encrypt / YR1",
"serial": "5fd077091d7191b142d4f9f37a89c439662",
"sha256": "49abbc75db2b26c18739e020e90e0cb6b7fa76704bd518c51b8807c38d094196",
"subject": "boc.hkbankserv.com",
"valid_to": "2026-12-19T18:23:21Z",
"valid_from": "2026-09-20T18:23:22Z"
},
"jarm": "2ad2ad16d2ad2ad00042d42d000000df133019600a83abfb096ff3e86cd79d",
"stats": {
"timeout": 0,
"harmless": 55,
"malicious": 0,
"suspicious": 0,
"undetected": 37
},
"whois": {
"dnssec": "unsigned",
"status": [
"clientTransferProhibited"
],
"created": "2026-09-20T17:14:32Z",
"expires": "2027-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"registrar": "Dynadot Inc",
"abuse_email": "abuse@dynadot.com",
"abuse_phone": "+16502620100",
"nameservers": [
"ns1.dyna-ns.net",
"ns2.dyna-ns.net"
],
"registrar_url": "http://www.dynadot.com",
"registrar_iana_id": "472"
},
"dns_at": "2026-10-23T05:55:13Z",
"created": "2026-09-20T17:14:32Z",
"expires": "2027-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"registrar": "Dynadot Inc",
"fetched_at": "2026-10-23T06:07:00Z",
"first_seen": "2026-09-20T19:46:14Z",
"reputation": 0,
"analysis_at": "2026-10-23T05:49:52Z"
},
"shots": {
"v": 1,
"cf": {
"url": "https://screenshots.phishdestroy.io/cf/c9fdea2a-f518-4b2e-be14-293ab6930e4e.png",
"scan": "c9fdea2a-f518-4b2e-be14-293ab6930e4e",
"bytes": 1008406,
"sha256": "1599a0fc26b6b7234215c1febc0729bc6198ea188c6b26344c85c28a1295601b"
},
"urlscan": {
"url": "https://screenshots.phishdestroy.io/01a1671e-31aa-749c-8b0b-e58953389d50.png",
"uuid": "01a1671e-31aa-749c-8b0b-e58953389d50"
},
"urlquery": {
"url": "https://screenshots.phishdestroy.io/uq/5fa082c2-2997-4648-b1ff-77cc6a9fb36b.png",
"bytes": 532584,
"report": "5fa082c2-2997-4648-b1ff-77cc6a9fb36b",
"sha256": "d568f1bc022b57046363a7f4f147b4a037c2a0d02b3bff72d1477f08e376c58d"
},
"fetched_at": "2026-11-02T04:43:06Z",
"urlscan_history": {
"scans": [
{
"at": "2026-10-23T05:02:43Z",
"url": "https://screenshots.phishdestroy.io/us/01a16723-9b3c-71ee-8ce8-dabcc84ad50c.png",
"uuid": "01a16723-9b3c-71ee-8ce8-dabcc84ad50c",
"bytes": 212306,
"sha256": "122c3c1a59de1ef353a50d01d75a08508b56757429bd1db049fcf7a30f712e06",
"status": 200,
"country": "SG",
"page_url": "https://boc.hkbankserv.com/",
"task_domain": "boc.hkbankserv.com"
},
{
"at": "2026-10-23T05:04:09Z",
"url": "https://screenshots.phishdestroy.io/us/01a16724-15b3-7477-867e-52c0c9ccacff.png",
"uuid": "01a16724-15b3-7477-867e-52c0c9ccacff",
"bytes": 237815,
"sha256": "364b29381d4c7d2de00c3c8a85b91d64363c351ba0e4a81e2db6593daf077eaa",
"status": 200,
"country": "SG",
"page_url": "https://boc.hkbankserv.com/",
"task_domain": "boc.hkbankserv.com"
},
{
"at": "2026-10-23T05:04:43Z",
"url": "https://screenshots.phishdestroy.io/us/01a16725-798f-774d-b5b2-e3c62092446f.png",
"uuid": "01a16725-798f-774d-b5b2-e3c62092446f",
"bytes": 292852,
"sha256": "61a6976a50c9d75aa897547fd95c03c1b096b7b07fb57665e186a16a7d349c50",
"status": 200,
"country": "SG",
"page_url": "https://boc.hkbankserv.com/",
"task_domain": "boc.hkbankserv.com"
}
],
"total": 4
}
},
"urlscan": {
"v": 1,
"ip": "144.172.85.35",
"ips": [
"202.127.170.52",
"172.64.146.215",
"2.21.20.143",
"144.172.85.35"
],
"tls": {
"san": [
"boc.hkbankserv.com"
],
"cipher": "AES_256_GCM",
"issuer": "YR1",
"subject": "boc.hkbankserv.com",
"protocol": "TLS 1.3",
"valid_to": "2026-12-19T18:23:21Z",
"valid_from": "2026-09-20T18:23:22Z"
},
"asns": [
"24396",
"13335",
"20940",
"14956"
],
"uuid": "01a1671e-31aa-749c-8b0b-e58953389d50",
"status": 200,
"cookies": [
"FontSize",
"bcookie",
"li_gc",
"lidc",
"__cf_bm"
],
"domains": [
"www.bochk.com",
"snap.licdn.com",
"px.ads.linkedin.com",
"cdn.chatway.app"
],
"globals": [
"startTime",
"detectMobile",
"_wcm_vlc",
"_wcm_ct",
"_wcm_cp",
"_wcm_cd",
"_wcm_cu",
"_wcm_cuj",
"_wcm_ce",
"_wcm_c",
"_wcm_co",
"_wcm_d",
"_wcm_vo",
"_wcm_do",
"_wcm_epv",
"_wcm_pa",
"_wcm_to",
"_wcm_i",
"_wcm_w",
"_wcm_performLinkClick",
"callSensor",
"_wcm_eventCapture",
"_wcm_captureLink",
"_wcm_captureLinkArea",
"_wcm_isMobileLink",
"_wcm_captureVideo",
"_wcm_det_link_type",
"_wcm_syncFinishAjax",
"_wcm_asyncFinishAjax",
"_wcm_linkCapture",
"determineLinkTitle",
"_wcm_isLinkWithImg",
"$",
"jQuery",
"sendRequest",
"formDataToJSONString",
"formElemToJSON",
"addJSONRecord",
"QR8bitByte",
"QRCode"
],
"headers": {
"server": "nginx",
"content-type": "text/html",
"referrer-policy": "same-origin",
"x-frame-options": "SAMEORIGIN",
"x-xss-protection": "1; mode=block",
"x-content-type-options": "nosniff",
"x-permitted-cross-domain-policies": "master-only"
},
"doc_hash": "4e487d557e3be6690f12d13df150f945c82350e37dc031e3ebed27aa7a9b26c8",
"requests": 88,
"verdicts": {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
],
"score": 93,
"malicious": true
},
"overall": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"bankofchina"
],
"malicious": true,
"categories": [
"phishing"
]
},
"urlscan": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"Bank of China"
],
"malicious": true,
"categories": [
"phishing"
]
}
},
"countries": [
"HK",
"DE",
"SG"
],
"final_url": "https://boc.hkbankserv.com/",
"fetched_at": "2026-10-23T05:39:45Z",
"scanned_at": "2026-10-23T04:56:44Z",
"link_domains": [
"www.bochk.com"
],
"storage_keys": [
"li_adsId"
],
"tls_age_days": 32,
"apex_age_days": 32,
"script_hashes": [
"8028beb041fb41956e80af9982bc9b113ab059a9882eb50f6d1e048d84182379",
"da06647b88a66fb8e0385816c398d746b1262f882a14e293834ca7eb928b940a",
"a84cb702fb991628b50583f252c01b53f1f6dec1ce87fa59ac3efabb7c3419cc",
"c4a8b3557758476503848e86bd07819627b7fe53112bf51a06e06552787dcc56",
"6fe9965e6af5fd5bcb5a883f3641b0aee0cfca92cda370ad7f2d7f986657c612",
"660397bc22eaee467ffcb448e77fe0c3a1d72e35a73a646a3dd9be4f3fab2fdf",
"634fbaf2b3678a5865bed5e7a85e32ff52b07bd2e5da5bb9f776ab25d83f4de8",
"d7a1aacaff128cba603b8155100f1a575d6bac36b140ee5c481cc4e196131ce9",
"a0fe8a1bce540943451e192de4545e4bd84313412a0855b99e89920b9d86c989",
"22f283a0a93273bbba9681875e02ac191516cb9738d2ba914d6536e255d1c1dc"
],
"tls_valid_days": 89,
"domain_age_days": 32
},
"cf_radar": {
"verdict": "clean",
"categories": [],
"is_malicious": false
},
"webcheck": {
"v": 1,
"dns": {
"A": [
"144.172.85.35"
]
},
"ssl": {
"issuer": "Let's Encrypt / YR1",
"subject": "boc.hkbankserv.com"
},
"hsts": {
"message": "Site does not serve any HSTS headers."
},
"ports": {
"open": [
22,
80,
443
]
},
"whois": {
"status": [
"clientTransferProhibited https://icann.org/epp#clientTransferProhibited"
],
"created": "2026-09-20T17:14:32Z",
"expires": "2027-09-20T17:14:32Z",
"updated": "2026-09-20T17:15:11Z",
"registrar": "Dynadot Inc",
"nameservers": [
"ns1.dyna-ns.net",
"ns2.dyna-ns.net"
]
},
"carbon": {
"bytes": 236747,
"co2_grams": 0.0087,
"cleaner_than": 3
},
"dnssec": {
"ds": false,
"rrsig": false,
"dnskey": false
},
"get_ip": {
"ip": "144.172.85.35",
"family": 4
},
"status": {
"up": true,
"code": 200,
"timings": {
"dns": 188,
"tls": 254,
"wait": 219,
"connect": 201,
"download": 796
},
"response_ms": 1658
},
"cookies": {
"cookies": [
{
"name": "FontSize"
},
{
"name": "bcookie",
"secure": true,
"same_site": "None"
},
{
"name": "li_gc",
"secure": true,
"same_site": "None"
},
{
"name": "lidc",
"secure": true,
"same_site": "None"
},
{
"name": "__cf_bm",
"secure": true,
"http_only": true,
"same_site": "None"
}
]
},
"headers": {
"headers": {
"server": "nginx",
"content-type": "text/html",
"referrer-policy": "same-origin",
"x-frame-options": "SAMEORIGIN",
"x-xss-protection": "1; mode=block",
"x-content-type-options": "nosniff",
"x-permitted-cross-domain-policies": "master-only"
}
},
"archives": {
"last": "2026-10-23T04:58:25Z",
"first": "2026-10-23T04:58:25Z",
"changes": 0,
"days_archived": 1,
"avg_page_bytes": 29845
},
"location": {
"ip": "144.172.85.35",
"asn": "14956",
"org": "RouterHosting LLC",
"city": "Singapore",
"country": "SG"
},
"trackers": {
"requests": 90,
"trackers": [
{
"name": "LinkedIn Ads",
"company": "Microsoft",
"country": "US",
"category": "Advertising",
"requests": 2
},
{
"name": "Cloudflare",
"company": "Cloudflare",
"country": "US",
"category": "Hosting",
"requests": 1
},
{
"name": "LinkedIn Analytics",
"company": "Microsoft",
"country": "US",
"category": "Site Analytics",
"requests": 2
}
]
},
"redirects": {
"chain": [
"https://boc.hkbankserv.com"
]
},
"dns_server": {
"ns": [
{
"ip": "162.159.25.5",
"host": "ns2.dyna-ns.net"
},
{
"ip": "162.159.27.158",
"host": "ns1.dyna-ns.net"
}
],
"zone": "hkbankserv.com"
},
"fetched_at": "2026-10-23T05:40:10Z",
"block_lists": {
"resolvers": 12,
"blocked_count": 0
},
"caa_records": {
"domain": "boc.hkbankserv.com"
},
"social_tags": {
"ogUrl": "https://boc.hkbankserv.com/",
"title": "中國銀行(香港)有限公司",
"ogType": "website",
"ogImage": "http://boc.hkbankserv.com/files/whatsapp.png",
"ogTitle": "中銀香港",
"ogDescription": "中銀香港為您提供創新、專業及全面的金融服務,助您創富增值,致力成為您的最佳銀行。"
},
"linked_pages": {
"external": [
"https://www.bochk.com/tc/home.html#",
"https://www.bochk.com/tc/home.html#.html",
"https://www.bochk.com/dam/wm/family-wealth-management/offer_tc.html",
"https://www.bochk.com/tc/creditcard/cip/ci.html",
"https://www.bochk.com/tc/home.html",
"https://www.bochk.com/tc/corporate.html",
"https://www.bochk.com/tc/corporate/casestudies.html",
"https://www.bochk.com/tc/corporate/commbanking.html",
"https://www.bochk.com/tc/corporate/ecomm.html",
"https://www.bochk.com/tc/corporate/cashmgt.html",
"https://www.bochk.com/tc/corporate/treasury.html",
"https://www.bochk.com/tc/corporate/card.html",
"https://www.bochk.com/dam/smeinone/crossborderbusinessfinancialsolutions/tc.html",
"https://www.bochk.com/tc/pw.html",
"https://www.bochk.com/tc/wm.html",
"https://www.bochk.com/tc/enrich.html",
"https://www.bochk.com/tc/enrich/offer.html",
"https://www.bochk.com/tc/enrich/tailoredinfo.html",
"https://www.bochk.com/tc/enrich/servicetype.html",
"https://www.bochk.com/tc/enrich/econanalysis.html",
"https://www.bochk.com/tc/ifree.html",
"https://www.bochk.com/tc/ifree/promotion.html",
"https://www.bochk.com/tc/ifree/parentsandchildren.html",
"https://www.bochk.com/tc/ifree/smartelderly.html",
"https://www.bochk.com/tc/ifree/student.html"
],
"external_count": 480,
"internal_count": 1
},
"http_security": {
"xFrameOptions": "SAMEORIGIN",
"referrerPolicy": "same-origin",
"xXSSProtection": "1; mode=block",
"permissionsPolicy": false,
"xContentTypeOptions": "nosniff",
"contentSecurityPolicy": false,
"strictTransportPolicy": false,
"crossOriginOpenerPolicy": false,
"crossOriginEmbedderPolicy": false,
"crossOriginResourcePolicy": false
},
"mixed_content": {
"no_sri": [
"https://cdn.chatway.app/widget.js?id=jCf22xEPWX4a"
],
"third_party_scripts": 1
},
"tls_connection": {
"alpn": "h2",
"cipher": "TLS_AES_256_GCM_SHA384",
"protocol": "TLSv1.3",
"versions": [
"TLSv1.2",
"TLSv1.3"
],
"authorized": true,
"forward_secrecy": true
}
},
"cf_radar_technologies": [
{
"app": "Adobe Experience Manager",
"icon": "Adobe Experience Platform.svg",
"name": "Adobe Experience Manager",
"website": "https://www.adobe.com/marketing/experience-manager.html",
"categories": [
{
"name": "CMS",
"priority": 1
}
],
"description": "Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.",
"confidenceTotal": 100
},
{
"app": "Java",
"icon": "Java.svg",
"name": "Java",
"website": "https://java.com",
"categories": [
{
"name": "Programming languages",
"priority": 5
}
],
"description": "Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.",
"confidenceTotal": 100
},
{
"app": "Nginx",
"icon": "Nginx.svg",
"name": "Nginx",
"website": "https://nginx.org/en",
"categories": [
{
"name": "Web servers",
"priority": 8
},
{
"name": "Reverse proxies",
"priority": 7
}
],
"description": "Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.",
"confidenceTotal": 100
},
{
"app": "Linkedin Insight Tag",
"icon": "Linkedin.svg",
"name": "Linkedin Insight Tag",
"website": "https://business.linkedin.com/marketing-solutions/insight-tag",
"categories": [
{
"name": "Analytics",
"priority": 9
}
],
"description": "LinkedIn Insight Tag is a lightweight JavaScript tag that powers conversion tracking, website audiences, and website demographics.",
"confidenceTotal": 100
},
{
"app": "HTTP/3",
"icon": "HTTP3.svg",
"name": "HTTP/3",
"website": "https://httpwg.org/",
"categories": [
{
"name": "Miscellaneous",
"priority": 10
}
],
"description": "HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.",
"confidenceTotal": 100
}
]
}Network requests: 88 SHA-256 hashes: 87 URLScan scan:
Network requests that the URLScan browser recorded while loading the page. URLScan does not provide a hash for every request. PhishDestroy retrieved this list on 2026-10-29 02:00 UTC.
Open this scan on URLScan 01a1671e-31aa-749c-8b0b-e58953389d50 ↗
| # | Network request | HTTP method · status | Type | Uncompressed size | Response body SHA-256 |
|---|
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
protected→dns_inactive
dns_nxdomain
protected
http_access_restricted · access_restriction
redirected
http_redirect
live_content→redirected
http_redirect
live_content
content_served
live_content
content_served
Reachable
Source: availability monitor. Every retained observation remains separate, including records with the same date or evidence hash but different sources or DNS states. An unknown state is not proof that the site is offline.
Recorded events: 10. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
0/92 engine detections
View sourcePD-20261023-C30C2D · Receipt 81744
Page archived
View sourceboc.hkbankserv.com
View sourcePage captured
View sourceWe scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
Browse this domain’s complete history by source. The download includes every record of the selected source. Dates retain their original field labels.
Download all records as JSON| ID | Stored data |
|---|
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
boc.hkbankserv.com PD-20261023-C30C2D Recipient: abuse@dynadot.com Registrar: Dynadot LLC / Dynadot Inc (United States) Policy Violations: Acceptable Use forbids illegal content; Spam & Abuse Policy prohibits phishing, fraud, malware; Dynadot may disable DNS and suspend domains Applicable Laws: CFAA 18 U.S.C. §1030, Wire Fraud 18 U.S.C. §1343, CAN-SPAM Act
Act on what you actually did. Entered a password: change it, and wherever you reused it. Paid or gave card details: contact your bank or payment service. Downloaded a file: scan the device. Then report the incident.
IC3 does not accept attachments. Keep original evidence for investigators. IC3 guidance
Federal tips line1-800-CALL-FBICurrent service: Report Fraud. England, Wales and Northern Ireland. Scotland: 101.
Contact centre0300 123 2040Report scams and fraud to the US Federal Trade Commission. Reports go into a database used by law enforcement.
Report cyber incidents and phishing to the US Cybersecurity and Infrastructure Security Agency.
Forward scam emails and text messages to the National Cyber Security Centre, which takes down the malicious sites it finds.
Emailreport@phishing.gov.uk Text messages7726Directory of national incident response teams (CSIRTs) in the EU. Find the team for your country.
Forward phishing emails to the Anti-Phishing Working Group.
Emailreportphishing@apwg.orgNational Cyber Crime Reporting Portal. For financial fraud, also call the 1930 helpline straight away.
Helpline1930Select your country to get official cybercrime contacts, or create a complaint draft →.
If you made a payment, contact your bank or payment service through its official contacts as soon as possible. Keep the address, dates, payment or transaction details and messages for a report to the police or another competent authority. A report does not guarantee that money is returned.
Scammers are criminals. Filing a report creates a legal record and helps protect others.
Template-based draft • optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
boc.hkbankserv.com)Even if you don't have all details — file a report anyway. Partial information still helps investigations.
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowSubmit suspicious domains to our threat database — protect the community
ReportRecent phishing reports and observed availability changes
MonitorMonitor live threats or contest this listing if you believe it's a false positive
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.