boafinancialpay[.]com[.]boafinancialcrediunion[.]com

This domain, boafinancialpay.com.boafinancialcrediunion.com, is identified as a brand impersonation threat targeting the BOA Financial brand. Analysis indicates the site presents itself under the title 'Home - BOA Financial Pay,' designed to deceive users into believing it is an official financial service portal. The campaign appears structured for credential theft, leveraging the trust associated with the targeted institution to harvest sensitive user information. No evidence of a crypto drainer kit or direct financial transaction malware was observed, but the domain's design aligns with credential harvesting tactics. Infrastructure analysis reveals the domain was registered on October 03, 2025, through Cosmotown, Inc., a registrar frequently associated with malicious registrations. It resolves to the IP address 192.3.190.189, hosted within the United States under AS36352 (HostPapa). The domain lacks an SSL certificate, increasing the risk of interception during data transmission. Detection metrics indicate elevated risk, with 10 out of 95 security vendors on VirusTotal flagging the domain as malicious. It appears on one security blocklist and is blocked by PhishDestroy, though it is not currently listed on Google Safe Browsing. As of the latest assessment, the domain has been taken offline, likely due to remediation efforts by hosting providers or security entities. However, the registrar and infrastructure remain active, posing a residual risk for potential re-deployment. Users who may have interacted with the domain are advised to monitor accounts for unauthorized activity and reset credentials as a precaution. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate related infrastructure for further malicious activity. The absence of SSL and the domain's recent creation underscore the need for heightened vigilance against similar impersonation attempts.