Skip to content
Live
Medium riskfirst seen 2 h ago

bankofameriсå.ph

xn--bankofameri-78a392i.ph

69of 100

Credential phishing, aimed at bank customers. 97% likely a scam.

Copies Bank of AmericaHosted in SingaporeNew domain

Why it was flagged

How the score works
  • Name and certificate
  • Registration and DNS
  • VAKYN verdict
  1. IDN "xn--bankofameri-78a392i" (bankofameriсå) reads as "bankofamerica", brand keyword "bankofamerica"+48
  2. no mail servers, AS63949 AKAMAI-LINODE-AP Akamai Connected Cloud, same IP hosts 50 other flagged domain(s)+14
  3. 3 hyphens, 23-character name, digit run+6
  4. certificate covers only this name+1

Evidence

Registration

Hosting

Country
Singapore
Network
AKAMAI-LINODE-AP Akamai Connected Cloud
IP
45.79.222.138

DNS

A
45.79.222.138
MX
none

Certificate

Issuer
Let's Encrypt
Names
1
Seen
30 Oct 2026 08:38 UTC

VAKYN verdict

473 ms

Eight questions about the site, each with how sure the answer is.

  • Likely used for phishing or a scam?

    yes97% sure

    • yes97%
    • no3%

  • How dangerous for an ordinary visitor?

    Clearly malicious56% sure

    • Clearly malicious56%
    • Probably malicious42%
    • Unclear2%

  • What is it most likely for?

    credential phishing55% sure

    • credential phishing55%
    • payment fraud20%
    • unclear8%

  • Which brand does it pretend to be?

    Bank of America78% sure

    • bank of america78%
    • none22%

  • Who is it aimed at?

    bank customers76% sure

    • bank customers76%
    • general public14%
    • shoppers4%

  • Would it ask visitors to sign in?

    yes72% sure

    • yes72%
    • no28%

  • Would it ask visitors to pay?

    yes74% sure

    • yes74%
    • no26%

  • Plausible innocent explanation?

    no98% sure

    • yes2%
    • no98%