# PhishDestroy domain threat record: bofadeez44.vercel.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/bofadeez44.vercel.app/ Machine-readable companion: https://phishdestroy.io/domain/bofadeez44.vercel.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-15 13:46:48 UTC - Last availability or vendor check: 2026-10-22 10:06:56 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 4/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Bank of America ## Stored infrastructure - Observed IP address: 64.29.17.3 - Registrar in stored WHOIS data: Tucows Domains Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, vercel.app): 2020-01-28 03:03:04 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/bofadeez44.vercel.app - Certificate Transparency search: https://crt.sh/?q=%25.bofadeez44.vercel.app - Web Archive lookup: https://web.archive.org/web/*/https://bofadeez44.vercel.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview bofadeez44.vercel.app is an impersonation phishing page on a free Vercel subdomain, and the crypto-focused blocklists that list it point to wallet users as the intended audience. PhishDestroy first saw it on 2026-09-15. On 2026-10-19 the site was still online with its content live. The browser tab currently reads "Example Domain," a generic placeholder title, while our classification is impersonation phishing. How the scam works Impersonation pages copy the look of a trusted service, such as a wallet, exchange or dApp, and send visitors to it through ads, direct messages or fake support replies. Once someone arrives, the page asks for a seed phrase, a login, or a wallet connection and transaction signature. Each of these hands control to the operator. A recovery phrase gives full access to the wallet, a password opens the account, and a signed approval lets the attacker move tokens without asking again. Because the page lives on a disposable subdomain, it can be rebuilt under a new name as soon as it is reported. Evidence MetaMask and SEAL, two blocklists maintained for the crypto ecosystem, list this domain alongside PhishDestroy. Those listings mean wallet software and security teams already treat the address as hostile. VirusTotal coverage is thin. On 2026-09-29, 4 of 91 engines flagged it: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet and VIPRE. That low count shows most general-purpose scanners have not caught up, so a clean result from your own antivirus should not reassure you. Infrastructure The site is a project subdomain on vercel.app, so no domain had to be bought or registered. That makes it quick and cheap to stand up and easy to replace. It resolves to 64.29.17.3 on an Amazon.com, Inc. network in the US. Its TLS certificate was issued automatically by Google Trust Services (WR1), so the padlock in the address bar says nothing about who runs the page. What to do If you typed a seed phrase or private key here, move your funds to a new wallet with a fresh phrase right away. Treat the old one as permanently compromised. If you connected a wallet or signed anything, revoke token approvals for that address with a reputable approval checker and watch it for unexpected transfers. If you entered a password, change it everywhere you reused it and turn on app-based 2FA. Defenders should block the full hostname rather than the shared parent domain, and report the subdomain to Vercel's abuse team so the deployment is pulled. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/bofadeez44.vercel.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bofadeez44.vercel.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:42:16 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5ae905bf-b10e-41a5-9f67-7ed2091cdf7e.png Captured: 2026-09-22 19:57:55 UTC Source report: https://radar.cloudflare.com/scan/5ae905bf-b10e-41a5-9f67-7ed2091cdf7e SHA-256: fbaf21472993c3caf52914ffc2fd31bb9f4d548176f74aaf43120771ccd80d18 - URLScan ยท 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a557-fbe0-703f-ace2-578a7f51dfa0.png Captured: 2026-09-15 13:53:53 UTC Source report: https://urlscan.io/result/01a0a557-fbe0-703f-ace2-578a7f51dfa0/ SHA-256: fa0c17f7251b48ac5c9bd63d3167cfc94f8e42ae7a3c77718013a3ef0d820d0a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:15Z", "uuid": "5ae905bf-b10e-41a5-9f67-7ed2091cdf7e", "scanned_at": "2026-09-22T19:57:55Z", "final_url": "https://bofadeez44.vercel.app/", "status": 200, "history": [ { "url": "https://bofadeez44.vercel.app/", "status": 200 } ], "dom_hash": "970dccc518a5a714cb50111dbdc9c2d49cc12146d11cd6e1e5da89b7bfff0587", "doc_hash": "c000160ba20804bcb1745e4cd234d84a3a6e2e7763842df10da5359eefb00a17", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bofadeez44.vercel.app", "type": "A", "value": "216.198.79.195" }, { "name": "bofadeez44.vercel.app", "type": "A", "value": "64.29.17.195" } ], "dnssec_valid": false, "ip": "216.198.79.195", "whois": { "registrar": "Tucows Domains Inc", "created": "2020-01-28T03:03:04Z", "updated": "2026-03-14T03:03:04Z", "expires": "2036-01-28T03:03:04Z", "nameservers": [ "ns1.vercel-dns-3.com", "ns2.vercel-dns-3.com", "ns3.vercel-dns-3.com", "ns4.vercel-dns-3.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:31:47Z", "analysis_at": "2026-10-14T04:55:04Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 3, "suspicious": 1, "undetected": 35 }, "detections": { "VIPRE": "malware", "Fortinet": "phishing", "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Tucows Domains Inc", "created": "2020-01-28T03:03:04Z", "expires": "2026-01-28T03:03:04Z", "updated": "2025-01-26T03:25:55Z", "first_seen": "2026-09-15T10:20:25Z", "dns": [ { "ttl": 300, "type": "A", "value": "216.198.79.3" }, { "ttl": 300, "type": "A", "value": "64.29.17.3" } ], "dns_at": "2026-10-14T04:55:31Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "*.vercel.app" ], "issuer": "Google Trust Services / WR1", "serial": "f7911168ffa7d0f4135e24792e7a52a8", "sha256": "8f46c4a0a289bfde4060d06986f2af761ee62d668dde972e6bef4687ee4f6093", "subject": "*.vercel.app", "valid_to": "2026-11-27T19:48:08Z", "valid_from": "2026-08-29T19:48:09Z" }, "whois": { "registrar": "Tucows Domains Inc", "registrar_iana_id": "69", "registrar_url": "http://www.tucows.com", "created": "2020-01-28T03:03:04Z", "updated": "2025-01-26T03:25:55Z", "expires": "2026-01-28T03:03:04Z", "status": [ "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.vercel-dns-3.com", "ns2.vercel-dns-3.com", "ns3.vercel-dns-3.com", "ns4.vercel-dns-3.com" ], "dnssec": "unsigned" } } } ```