carmoneydrive[.]com[.]edbtpro[.]com

The domain carmoneydrive.com.edbtpro.com is a phishing site engaged in brand impersonation, specifically targeting Bank of America customers. It presents itself as a legitimate service but is designed to harvest login credentials and personal information through deceptive means. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk, but prior visitors may still be vulnerable to follow-up attacks.

Technical analysis shows carmoneydrive.com.edbtpro.com was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned it a trust score of 0/100. Google Safe Browsing did not flag the domain, but it appeared on 1 security blocklist (PhishDestroy). The domain was created on 2026-02-21 07:01:08 and resolved to the IP address 213.165.249.109, located in the Netherlands under AS22611 (InMotion Hosting, Inc.). The SSL certificate was issued by R10, and the observed page title was 'Carmoneydrive - Car Rentals', a misleading front for its phishing activity.

Individuals who interacted with carmoneydrive.com.edbtpro.com should immediately change any exposed Bank of America credentials, enable two-factor authentication (2FA), and monitor accounts for unauthorized transactions. Report the phishing domain to Bank of America’s fraud team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts. If financial data was entered, contact the bank to secure accounts and review recent activity for signs of fraud.