boafinancepay[.]com

This domain, boafinancepay.com, is flagged for brand_impersonation targeting Mastercard financial services. Analysis indicates the site presented itself as a payment portal under the title 'BOA Finance Pay,' mimicking legitimate banking infrastructure to harvest credentials or financial data. No drainer kit signatures were identified in available telemetry, though the domain exhibits characteristics consistent with credential phishing campaigns. Infrastructure analysis reveals the domain was registered on November 10, 2025, through Dynadot LLC and resolves to the IP address 192.3.190.186. Security vendor detections on VirusTotal stand at 6/95, while Gridinsoft assigns a trust score of 0/100 and Scamadviser rates it at 25/100. The domain appears on one security blocklist and was issued an SSL certificate labeled 'PhishDestroy.' Google Safe Browsing does not currently list the domain, though this may reflect delayed propagation rather than absence of malicious intent. As of the latest verification, boafinancepay.com has been taken offline, likely in response to detection by PhishDestroy or other monitoring systems. While the immediate threat is mitigated, the infrastructure remains registered and could be reactivated. Organizations should monitor for re-emergence on the same IP or registrar, particularly if associated with similar naming conventions or SSL certificate issuers. Network defenders are advised to block the domain and IP at perimeter controls and alert users to potential phishing attempts referencing 'BOA Finance Pay' or Mastercard branding.