bankofamericalogin[.]sbs

Analysis shows that bankofamericalogin.sbs is engineered to impersonate Bank of America, as indicated by the page title "Bank of America - Personal Banking" and the listed scam type of Banking Phishing. The domain resolves to IP 64.29.17.1, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. Hosting is provided through Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com), and the site operates without an SSL certificate, meaning all traffic is unencrypted. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 21 of 93 security vendors have flagged it, reinforcing the malicious classification.

AlienVault OTX references the domain in two separate threat‑intelligence pulses, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Registration was performed through Name.com, Inc. on 24 December 2025.

Although the site has been taken offline, the infrastructure artifacts remain observable. Defenders should ensure the domain is blocked at the DNS layer, add the IP address to network‑level deny lists, and update email‑gateway filters to catch references to the domain or its associated brand. Continuous monitoring of Vercel‑hosted assets and Amazon‑assigned IP ranges for similar brand‑impersonation patterns is advised, as the combination of a brand‑specific page title, lack of TLS, and strong detection signals suggests a high‑confidence phishing operation.