Scam Lookup
Automated Website Trust & Risk Intelligence Report
https://scamlookup.net/website/bankofamerica.com
Generated: Fri, 13 Nov 2026 15:44:05 GMT
Target Website: bankofamerica.com
Overall Trust Score: 90/100 (Trusted)
Is bankofamerica.com safe?
Very Likely Safe
No major red flags found. This looks like a legitimate, established website.
Checked Nov 13, 2026
90
Trust score
Why: Main reasons: domain registered 28+ years ago; not flagged by Google Safe Browsing; bankofamerica is the real brand's registered domain. Minor issues: site returned HTTP 403; missing HSTS.
Identity & Age100/100
Impersonation Risk100/100
Red Flags100/100
Transparency70/100
Security62/100
Email100/100
Positive highlights
- Domain registered 28+ years agoLong-established domains are far less likely to be disposable scams.
- Not flagged by Google Safe BrowsingNo malware, phishing, or unwanted-software match in Google's live threat database.
- HTTPS is enforcedAll redirects stayed on HTTPS. Traffic is encrypted end-to-end.
- bankofamerica is the real brand's registered domainThe root label matches the brand exactly — this IS the brand's own domain.
- HTTPS works with a valid certificateA secure connection was made on port 443. Certificate log details were unavailable at scan time.
- No impersonation patterns detectedDomain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.
- Not listed on URLhaus malware blocklist
- Fast response (345ms)
- Not present in PhishStats phishing feed
- DMARC published (reject)
Negative highlights
- Site returned HTTP 403The server is reachable but did not return a success status.
- Domain contains brand token(s): bankThird-party sites that embed a well-known brand name in their domain are frequently used for phishing.
- Missing HSTSTells browsers to only use HTTPS for this domain.
- Missing Content Security PolicyRestricts which scripts and resources the page can load.
Note: Registered via CSC Corporate Domains, Inc..
Note: 1 technologies detected. Cloudflare
Note: Policy pages could not be checked. The site showed our scanner a bot-check or short page, so privacy, terms and contact pages were not verified. This is common for large sites and is not counted against them.
Key facts about bankofamerica.com
- Website
- bankofamerica.com
- Popularity
- Not checked
- Domain created
- Dec 28, 1998 (27.9 years old)
- Domain expires
- Dec 28, 2026
- Registrar
- CSC Corporate Domains, Inc.
- Owner details
- Public in WHOIS
- IP address
- 3.173.21.90
- Hosting / CDN
- Cloudflare
- SSL certificate
- HTTPS works (certificate details unavailable)
- Email security
- SPF ✓ · DMARC ✓ (reject)
- Threat blocklists
- Not listed (clean)
- Technology
- Cloudflare
Summary
90/100 — trusted. Long-established domain (27.9 years old), clean threat reputation, no impersonation patterns.
No malware/phishing on feedsGood reputationHTTPS enabled
Full technical report
Domain Information
Registration timeline, age calculation, registrar details, and ICANN status.
Verified
- Registrar Name
- CSC Corporate Domains, Inc.
- Creation Date
- December 28, 1998 (27.9 years ago)
- Last Updated
- June 10, 2026
- Registry Expiry Date
- December 28, 2026
- WHOIS Privacy Protection
- Publicly Visible
- Domain Status Codes
- client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
ICANN Status Badges
client transfer prohibitedserver delete prohibitedserver transfer prohibitedserver update prohibited
Domain registered 28+ years ago
Long-established domains are far less likely to be disposable scams.
+15
Registered via CSC Corporate Domains, Inc.
Owner information disclosed
The domain publishes registrant contact info — a small positive transparency signal.
+2
HTTP Headers & Security
Full HTTP response headers, HSTS, Content Security Policy (CSP), and security baselines.
Warning
Security Header Baseline
Strict-Transport-SecurityMissing
Content-Security-PolicyMissing
X-Frame-OptionsMissing
X-Content-Type-OptionsMissing
Referrer-PolicyMissing
Permissions-PolicyMissing
Recommended Missing Headers
missing: HSTSmissing: Content Security Policymissing: X-Frame-Optionsmissing: X-Content-Type-Optionsmissing: Referrer Policymissing: Permissions Policy
All Response Headers (11)
cf-cache-status: DYNAMIC cf-ray: a59ee555df553564-CMH connection: close content-length: 371 content-type: text/html date: Fri, 13 Nov 2026 15:44:06 GMT expires: Fri, 13 Nov 2026 15:44:06 GMT mime-version: 1.0 server: cloudflare set-cookie: akacd_BAC_eComm_www_Splash_PROD=3972037445~rv=16~id=9cfdce1969532d0937d09261a9f9f056; path=/; Secure; SameSite=None x-bac-akm-c: ON
Missing HSTS
Tells browsers to only use HTTPS for this domain.
-4
Missing Content Security Policy
Restricts which scripts and resources the page can load.
-4
Missing X-Frame-Options
Prevents clickjacking by disallowing framing.
-3
Missing X-Content-Type-Options
Blocks MIME-sniffing browser attacks.
-2
Missing Referrer Policy
Controls what referrer information is sent with requests.
-2
Missing Permissions Policy
Restricts access to powerful browser features (camera, mic, etc.).
-2
DNS Records
Encrypted DoH resolution: A, AAAA, MX mail servers, authoritative NS, and TXT verification.
Resolved
- IPv4 Addresses (A)
- 3.173.21.90, 3.173.22.90, 3.173.23.90
- IPv6 Addresses (AAAA)
- None
- Mail Servers (MX)
- mxa-0000ec05.gslb.pphosted.com (Priority: 10), mxb-0000ec05.gslb.pphosted.com (Priority: 10)
- Authoritative Nameservers (NS)
- a.ns-bac.com, b.ns-bac.org, c.ns-bac.net, d.ns-bac.info, e.ns-boa.biz, f.ns-boa.us, g.ns-bac.com
- TXT Records Found
- 72 TXT verification records
A Records (IPv4)
3.173.21.903.173.22.903.173.23.90
TXT Verification Records
MS=ms26780064
00D0b000000De84=1TBKW000000GmaA
00D1D000000jT9H=1TBDR0000008OIt
00D210000002QLf=1TBDl0000008OKR
00D2g0000000ZPI=1TBD1000000003M
00D300000000K1b=1TBKZ0000004CFQ
00D300000000Lsb=1TBHp0000008OIF
00D300000005zGi=1TBKe000000oLob
00D3000000071D4=1TBKX0000008OLJ
00D30000000nW2o=1TBKd000000000B
00D30000000nqfl=1TBHt000000CaRH
00D30000001FXpf=1TBHt000000000Q
00D30000001H1Cv=1TBHt000000000B
00D30000001H88T=1TBKX000000Gmb7
00D30000001HRSt=1TBKe000000blLi
00D36000000rZom=1TBHq0000004C9D
00D37000000J5Lh=1TBKb000000TN74
00D3K0000008lCp=1TBDc0000008OM2
00D400000007EoN=1TBKY000000fxU2
00D46000000aATr=1TBKk0000000007
00D4C0000008x25=1TBD10000004CCb
00D52000000JPHM=1TBDU000000Gma9
00D60000000KTAU=1TBKZ000000001T
00D700000009PLP=1TBKe0000004C9D
00D750000000NEs=1TBDh0000004CB9
00D7g0000005BwN=1TBD70000004CB9
00D8I0000016LkC=1TBDa000000000a
00DD50000009T2F=1TBD50000004CCI
00DDE0000045mMg=1TBDE000000CaRH
00DDG00000NAncy=1TBDG0000008OKX
00DDL00000D40CM=1TBDL000000001O
00DDU00000081t1=1TBDU000000GmaU
00DDY0000000PuC=1TBDY0000004C9D
00DDc0000005CbI=1TBDc0000004CEs
00DDk000000E4pS=1TBDk0000008ONA
00DDn00000122RU=1TBDn0000004C9E
00DDn0000014WHa=1TBDn000000XZAR
00DDn0000014WMF=1TBDn0000000006
00DE0000000ZaqE=1TBHt000000XZEJ
00DHo000007ESQH=1TBHo000000sXtb
00Dd0000000fllf=1TBKh000000Kynr
B2B8A4C34008BEF0023A22BE8CA6A799
C88C9B78D75886CF03030263D6E5D6AC
_mue2mr9ttx0pb28iu4vju44fyivlze2
79HRM45BZQL4W6DODHCJ08ICCEPI4ZZ95OPF1PODC
N73NW9KHOCFO1J30DG9M0U52P3KJYN458U7T7MOAO
apple-domain-verification=8NQqHRIawsPLpi0W
apple-domain-verification=d7eRv0GK7kdI6vEs
apple-domain-verification=rELhhF8gjKgBEMuH
ccisso=4d9729b7-b770-4856-947d-935d1b4dca9c
docusign=7d338bac-902f-4792-8cdb-89a34b44ccf6
docusign=7f619a20-e6e1-47ba-88e2-5ffde1224228
facebook-domain-verification=vzgeob2q58bgtl7degzq855tbt3nld
onetrust-domain-verification=e788a6ac2ccb43818ec10f692be6c065
webexdomainverification.=28c49c72-742e-4204-a733-18e8a8982a47
webexdomainverification.=9caf3cdf-4b7a-4806-8346-9a9591002ef3
webexdomainverification.AU51=01da9742-a899-4543-b134-6dba5c7669f0
webexdomainverification.BV9Q=6a8ae93e-8405-4430-91c6-1095ff8ab83a
webexdomainverification.D04F=58ac4583-65d7-4b3d-89e2-2657f01be854
webexdomainverification.D182=d3bd60b7-b138-488e-9ce4-bb6a965bd46c
webexdomainverification.DMQQ=2397072c-14ba-446b-af2b-b7d82b0c3d84
webexdomainverification.DPFR=fc6d9245-b5e5-456d-a469-6332595f0a02
webexdomainverification.EPKA=0bb7fd7a-0b2a-4645-ab25-62a5a06a68f1
webexdomainverification.KK43=938a1277-bf6a-441d-949c-c22f81ce00e0
webexdomainverification.KK48=150225ca-a113-4206-9228-4e3460b52486
webexdomainverification.1TKBV=0b486704-ef66-4735-96f0-8b4af777b303
webexdomainverification.1TKU2=55bfd798-3032-4b19-9e4d-1a3cdc9f83dd
webexdomainverification.7VRFC=41f26899-9147-46be-927a-64a4921bce12
webexdomainverification.8BOEU=a4a75bdf-0a9d-419b-bad5-09ed7837a3a4
apple-domain-verification=_tTrLth1tZlC6XJXF7Ot2qt-U0o_cPfdE1qif1tDlDo
XP24tQeCoyIoYKFUDBai/TAmSrkfqDi8E276kwIOINKuXcgwMZwhckPM+6x5egH7+IV5OFBRNkdgRIHmbQ4Usw==
v=spf1 ip4:171.161.41.178 ip4:171.159.227.167 ip4:171.161.147.155 include:spf-0000ec15.pphosted.com ~all
3 address record(s) resolved
+4
7 authoritative nameservers
+2
WHOIS & Identity Lookup
Domain ownership status, registry lifecycle, nameservers, and privacy redaction.
Found
- Registrable Domain
- bankofamerica.com
- Registrar Organization
- CSC Corporate Domains, Inc.
- WHOIS Privacy Status
- Public Registration Data
- Registry Status Codes
- client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
- Delegated Authoritative Nameservers
- a.ns-bac.com, b.ns-bac.org, c.ns-bac.net, d.ns-bac.info, e.ns-boa.biz, f.ns-boa.us, g.ns-bac.com
- Registration Lifecycle
- Registered: 1998 → Expires: 2026
Nameservers (NS)
a.ns-bac.comb.ns-bac.orgc.ns-bac.netd.ns-bac.infoe.ns-boa.bizf.ns-boa.usg.ns-bac.com
Domain registered 28+ years ago
Long-established domains are far less likely to be disposable scams.
+15
Registered via CSC Corporate Domains, Inc.
Owner information disclosed
The domain publishes registrant contact info — a small positive transparency signal.
+2
Email Security & Deliverability
SPF record validation, DMARC policy enforcement, DKIM selectors, and MX reputation.
Protected
- SPF Record
- v=spf1 ip4:171.161.41.178 ip4:171.159.227.167 ip4:171.161.147.155 include:spf-0000ec15.pphosted.com ~all
- DMARC Policy Mode
- Policy: REJECT
- DMARC Raw Record
- v=DMARC1; p=reject; fo=1; rua=mailto:auth.report_ns@bankofamerica.com; ruf=mailto:bankofamerica@ruf.agari.com
- DKIM Selectors Detected
- None detected
Email Protection Summary: This domain has strong email authentication configured to prevent spammers from sending emails impersonating this brand.
SPF record published
+5
DMARC published (reject)
+6
Threat Intelligence & Blocklists
Multi-source malware feeds (URLhaus), phishing checks (PhishStats, Safe Browsing), and typosquats.
Clean
URLhaus Malware
Clean / Not Listed
PhishStats Feed
Clean / Not Listed
Google Safe Browsing
Clean / Verified
- Root Domain Label
- bankofamerica
- Top-Level Domain (TLD)
- .com (Standard TLD)
- Punycode Obfuscation
- No (Standard ASCII)
- Homoglyph / Lookalike Script
- No mixed scripts
- Brand Match Analysis
- Official Domain (bankofamerica)
- Typosquatting Risk
- Clean
bankofamerica is the real brand's registered domain
The root label matches the brand exactly — this IS the brand's own domain.
+10
No impersonation patterns detected
Domain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.
+8
Technology Stack & Metadata
Detected CMS, JavaScript frameworks, analytics tags, CDN providers, and page metadata.
Detected
Detected Technologies by Category
cdn
Cloudflare
Page Metadata & Fingerprint
- HTML Title
- Access Denied
- Meta Description
- —
- Document Language
- en
- Character Encoding
- utf-8
- Viewport Setting
- width=device-width
- Generator Software
- —
1 technologies detected
Cloudflare
Page Performance & Compression
Server response time, content payload size, Brotli/Gzip compression, and caching rules.
345ms
Items to Fix & Optimize
Text compression (Brotli/Gzip)
MUCH NEEDEDEnable on server or CDN
Modern image formats (WebP/AVIF/SVG)
OPTIONALConvert heavy images to WebP/AVIF
Protocol
HTTP/2
Binary framing, multiplexed
Compression
NONE
No compression detected
Optimization Signals (From Detectable Headers & Assets)
Image Formats
Legacy / Unchecked
Transfer
Uncompressed
Transport
HTTP/2
These are server-side signals. Actual Core Web Vitals (LCP, INP, CLS) require real-user measurement via PageSpeed Insights.
Detected Asset & Image Formats
WebPAVIFSVGJPEGPNG
- HTTP Response Time
- 345 ms
- Payload Body Size
- 0.4 KB
- Compression Status
- Uncompressed
- Cache Directives
- Standard caching rules
No findings.
AI Content Safety & Red Flags
High-pressure language, payment gateway safety, disposable domain analysis, and deceptive tactics.
Safe
AI Content Evaluation
90/100 — trusted. Long-established domain (27.9 years old), clean threat reputation, no impersonation patterns. Main reasons: domain registered 28+ years ago; not flagged by Google Safe Browsing; bankofamerica is the real brand's registered domain. Minor issues: site returned HTTP 403; missing HSTS.
- Payment Red Flags
- None (No suspicious payment requests)
- High-Pressure Language
- None (No artificial urgency detected)
- Disposable Domain Risk
- No (Established infrastructure)
- Text Scanned Depth
- 293 characters verified
No scam-correlated language found on the home page
No crypto-only / gift-card / wire-only payment demands, and no obvious urgency tactics.
+6
Server & Hosting Infrastructure
Primary IP address, web server software, CDN edge network, and redirect hop chain.
cloudflare
- Primary Web Server
- cloudflare
- CDN / Cloud Provider
- Cloudflare
- Primary IP Address
- 3.173.21.90
- HTTP Status Code
- 403 OK
- Final Landing Destination
- https://www.bankofamerica.com/
- Redirect Hop Count
- 1 hop
Redirect Hop Chain
- 1.https://bankofamerica.com/ → https://www.bankofamerica.com/
Site returned HTTP 403
The server is reachable but did not return a success status.
-6
HTTPS is enforced
All redirects stayed on HTTPS. Traffic is encrypted end-to-end.
+10
Fast response (345ms)
+6
Served through Cloudflare
Sites behind a major CDN benefit from DDoS protection and edge caching.
+4
SSL / TLS Certificate
Active Certificate Authority, Common Name, validity period, expiration countdown, and SANs.
Secure
- Certificate Authority (Issuer)
- Not available (certificate logs did not respond)
- Subject Common Name (CN)
- —
- Validity Period
- Not available
- Subject Alternative Names (SANs)
- 1 domain protected
- Certificates Logged (CT)
- Verified in live TLS
Subject Alternative Names (Sample)
bankofamerica.com
HTTPS works with a valid certificate
A secure connection was made on port 443. Certificate log details were unavailable at scan time.
+8
Content & Transparency Policies
Linked privacy policy, terms of service, about page, social channels, and published contacts.
Warning
Key Legal & Transparency Pages
privacy PageNot linked
terms PageNot linked
contact PageNot linked
about PageNot linked
refund PageNot linked
shipping PageNot linked
cookies PageNot linked
- Published Phone Numbers
- 1794584646
Policy pages could not be checked
The site showed our scanner a bot-check or short page, so privacy, terms and contact pages were not verified. This is common for large sites and is not counted against them.
Robots.txt & Sitemap Discoverability
Search engine crawler directives, indexability, and declared XML sitemaps.
Missing
- Robots.txt Directives
- Not Found
- Sitemaps Declared
- None in robots.txt
- Disallow Rules Count
- 0 rules
No findings.
Export & Share Intelligence
Download the complete official PDF verification report (all sections and technical signals expanded), or export raw JSON telemetry.
Scan Engine Performance
Automated multi-signal inspection pipeline
Signals Analyzed
28
This scan
Sources Checked
19
Live security feeds
Scan Duration
2.55s
Fast scan
Last Scan
11/13/2026
Live timestamp
Overall Risk
Low Risk
User reviews of bankofamerica.com
No reviews yet. Be the first to share your experience.