boacustomerhelp[.]com

The domain boacustomerhelp.com is identified as a high-risk phishing infrastructure specifically designed to impersonate Bank of America customer support portals. Analysis confirms this domain as a generic_phishing threat, currently offline but previously active in credential harvesting operations. The site was structured to mimic legitimate banking login pages, likely targeting unsuspecting users through email or SMS-based social engineering campaigns. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on December 14, 2025, with resolution to IP address 198.18.1.106. No SSL certificate was present, increasing the likelihood of plaintext credential transmission. Security telemetry shows the domain was flagged by 20 of 95 vendors on VirusTotal, while Google Safe Browsing explicitly classified it as phishing. The domain appears on one security blocklist, suggesting limited but confirmed detection across threat intelligence platforms. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active period. Organizations are advised to block the domain and IP at perimeter security controls, while end users should verify any communication claiming to be from Bank of America through official channels only. Financial institutions should monitor for compromised credentials potentially harvested through this campaign, particularly those matching the December 2025 activity window. The absence of HTTPS and use of a recently registered domain with no legitimate history are strong indicators of malicious intent.