bluebankofamerica[.]com

Analysis as of July 23, 2026 indicates that the domain www.bluebankofamerica.com is being leveraged to impersonate Bank of America, consistent with a banking phishing classification. The domain was registered on February 21, 2026 through Name.com, Inc., and is hosted on the IP address 198.251.89.34, which belongs to AS53667 FranTech Solutions located in the United States. DNS resolution is serviced by ns21.asurahosting.com and ns22.asurahosting.com, and an MX record points to bluebankofamerica.com, suggesting potential email capabilities.

The site presents a valid TLS certificate issued by Let’s Encrypt (R13), but the HTTP response is a 301 redirect, and server fingerprinting reveals LiteSpeed web server software with client‑side libraries including jQuery, jQuery UI, and support for HTTP/3. Threat‑intelligence aggregators have flagged the domain: 12 of 93 VirusTotal scanners report malicious activity, it appears on one security blocklist and is actively blocked by PhishDestroy, and AlienVault OTX lists the domain in two separate threat pulses. The page title returned by the server is "www.bluebankofamerica.com," providing no further context.

While the technical footprint confirms a high‑risk, active phishing infrastructure, the actual landing page content has not been publicly disclosed, leaving the exact credential‑capture mechanisms uncertain. Defenders should immediately add the domain and its associated IP address to blocklists, monitor DNS queries for the listed nameservers, and enforce URL filtering for any HTTP/3 traffic to the host. Continuous scanning with multi‑vendor engines is advised to capture any changes in detection scores, and intrusion‑detection signatures should be updated to reference the observed LiteSpeed and jQuery stack fingerprints.