towns[.]community

Analysis of towns.community indicates a phishing domain targeting American Express customers, despite displaying a Bank of America-themed page title. The domain was registered on August 6, 2025, through Web Commerce Communications Limited (WebNic.cc) and resolves to IP 179.43.188.122, hosted on AS51852 (Private Layer INC) in Switzerland. The SSL certificate is issued by GlobalSign, a common feature in phishing infrastructure to lend superficial legitimacy. The site's page title, 'Bank of America | Online Banking | Forgot User ID & Password,' suggests an attempt to deceive users into entering credentials, though the mismatch with the declared brand target (American Express) may indicate a broader or repurposed phishing kit. Security vendors have flagged this domain as malicious, with 8 of 93 engines on VirusTotal detecting it as phishing-related.

It appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. AlienVault OTX includes the domain in one threat intelligence pulse, further corroborating its association with malicious activity. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. As of July 24, 2026, the domain is offline, though its prior infrastructure and detection history warrant continued monitoring. Defenders should treat this domain as confirmed phishing infrastructure, particularly for financial credential theft.

Network-level blocking of the IP (179.43.188.122) and domain is recommended. Given the registrar and hosting provider, similar domains may emerge from the same threat actor. Security teams should review logs for prior connections to this domain or IP, particularly in contexts involving financial services or credential submission. No evidence links this domain to a specific phishing kit or campaign beyond the banking phishing classification provided.