Bank of America lookalike domains
Greyphish has recorded 184 domains that resemble Bank of America since February 2026, 13 of them in the last 90 days. Most of them (71%) are typosquats, a keystroke or two away from the real name. .com carries 91% of them, out of 13 endings in all. The pace has picked up, with 8 in the last 30 days against 2 in the 30 before. 733 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Data as of . Public sources only.
What kind of lookalikes
Lookalikes per week
Show as a table
| Week of | Typo | Combo | Homoglyph | Total |
|---|---|---|---|---|
| 2026-04-20 | 4 | 1 | 0 | 5 |
| 2026-04-27 | 0 | 1 | 0 | 1 |
| 2026-05-04 | 3 | 1 | 0 | 4 |
| 2026-05-11 | 1 | 0 | 0 | 1 |
| 2026-05-18 | 1 | 1 | 0 | 2 |
| 2026-05-25 | 0 | 1 | 0 | 1 |
| 2026-06-01 | 0 | 3 | 1 | 4 |
| 2026-06-08 | 2 | 3 | 0 | 5 |
| 2026-06-15 | 6 | 2 | 0 | 8 |
| 2026-06-22 | 3 | 3 | 1 | 7 |
| 2026-06-29 | 2 | 1 | 0 | 3 |
| 2026-07-06 | 1 | 1 | 0 | 2 |
| 2026-07-13 | 1 | 0 | 1 | 2 |
| 2026-07-20 | 0 | 0 | 1 | 1 |
| 2026-07-27 | 0 | 0 | 0 | 0 |
| 2026-08-03 | 0 | 0 | 0 | 0 |
| 2026-08-10 | 0 | 0 | 0 | 0 |
| 2026-08-17 | 2 | 0 | 0 | 2 |
| 2026-08-24 | 0 | 0 | 0 | 0 |
| 2026-08-31 | 0 | 0 | 0 | 0 |
| 2026-09-07 | 0 | 0 | 0 | 0 |
| 2026-09-14 | 0 | 1 | 0 | 1 |
| 2026-09-21 | 0 | 2 | 0 | 2 |
| 2026-09-28 | 2 | 1 | 0 | 3 |
| 2026-10-05 | 0 | 1 | 0 | 1 |
| 2026-10-12 | 0 | 1 | 0 | 1 |
Endings
The 8 most used of the 13 top-level domains these lookalikes sit under.
| Ending | Lookalikes | Share |
|---|---|---|
| .com | 168 | 91.3% |
| .bond | 2 | 1.1% |
| .live | 2 | 1.1% |
| .net | 2 | 1.1% |
| .ws | 2 | 1.1% |
| .at | 1 | 0.5% |
| .click | 1 | 0.5% |
| .lat | 1 | 0.5% |
Where they are registered
For the 165 with a registrar in WHOIS (90% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Above.com | 26 | 15.8% | Retail |
| GoDaddy | 26 | 15.8% | Retail |
| Media Elite Holdings | 19 | 11.5% | Retail |
| Internet Domain Service BS | 14 | 8.5% | Retail |
| Dynadot | 9 | 5.5% | Retail |
| Cloudflare | 5 | 3.0% | Retail |
| Key-Systems | 5 | 3.0% | Retail |
| OwnRegistrar | 4 | 2.4% | Retail |
What the live ones do
11 of these lookalikes were registered and checked for a website and mail: 2 (18%) served a website and 6 (55%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
Google Web Risk lists 3 of the 4 live ones checked against it.
4 were tracked while live and 1 has since gone down. See what to do about a lookalike.
Recent examples
The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Bank of America; it is not necessarily malicious, and none of these is a claim about who registered it or why.
bankofamericahelpdesk[.]comCombo, Oct 13Listed by Google Web RiskNo site or mail when checkedbankofamericacenterhouston[.]comCombo, Oct 5Serves a websiteMX recordsbankofamericasecurecare[.]comCombo, Oct 4Listed by Google Web RiskNo site or mail when checkedbankofamericac[.]comTypo, Oct 3Not checkedbankofalmerica[.]comTypo, Sep 30Not checkedbankofamerica-onlinebanking-login[.]bondCombo, Sep 23Not checkedbankofamerica-login[.]bondCombo, Sep 23Listed by Google Web RiskNot checkedbankofamericaofficial[.]comCombo, Sep 20Not checkedbankofamericap[.]comTypo, Aug 19Not checkedbakofamerica[.]comTypo, Aug 18Not checked
Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.
Further reading
More in banking and payments
Greyphish is not affiliated with Bank of America. Domains listed resemble Bank of America by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.