finance banking

phishing scam

corporate business

documentation technical

government public service

English

OptanonConsent

OptanonAlertBoxClosed

_cid_cc

SPID

ccts

AFAPPJSESSIONID

TS01de9ce4

SMREDIRECT

TS01822895

_bofalid

CPRID

OBBREDIRECT

INTUITREDIRECT

You're looking at domain 'online3.cashpro.bankofamerica.com' on the commercial generic top-level domain (.com) and includes subdomain 'online3.cashpro'. The second-level label 'bankofamerica' is 13 characters long split between six vowels and 7 consonants. It segments into three words: bank, of, america. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

companyId

userId

passcode

frmSignIn

loginPhxButton

qrPhxButton

cpoLoginForm

html/2e/16/2e1618a7-ed74-4a32-a8e7-a8a22720da76.html.gz

default-src 'self' *.bankofamerica.com:* https://cdn.cookielaw.org https://geolocation.onetrust.com https://privacyportal-bofa.my.onetrust.com/ https://api.ipify.org; style-src 'self' *.bankofamerica.com:* 'nonce-sx0FtO43AC4HR7A26Fa7'; img-src 'self' *.bankofamerica.com:* https://cdn.cookielaw.org data: ; script-src 'self' *.bankofamerica.com:* https://cdn.cookielaw.org https://api.ipify.org  blob: 'nonce-sx0FtO43AC4HR7A26Fa7';

default-src 'self' https://*.bankofamerica.com https://privacyportal-bofa.my.onetrust.com; script-src 'self' https://*.bankofamerica.com https://cdn.cookielaw.org https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-qrC4rUfGsot3Ha58eht3'  ; script-src-elem 'self' https://*.bankofamerica.com https://cdn.cookielaw.org https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-qrC4rUfGsot3Ha58eht3'; style-src 'self' https://*.bankofamerica.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-qrC4rUfGsot3Ha58eht3' ;font-src 'self' https://*.bankofamerica.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-qrC4rUfGsot3Ha58eht3'; connect-src 'self' wss://*.bankofamerica.com https://*.bankofamerica.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://privacyportal-bofa.my.onetrust.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com; img-src 'self' data: https://*.bankofamerica.com https://cdn.cookielaw.org https://*.ml.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com;  worker-src 'self' blob: https://*.bankofamerica.com; frame-src 'self' blob: https://*.bankofamerica.com https://*.highradius.com https://*.ml.com https://*.identrust.com https://*.digsigtrust.com; frame-ancestors 'self' https://*.bankofamerica.com https://*.highradius.com https://*.ml.com https://*.identrust.com https://*.digsigtrust.com

script-src 'self' 'nonce-wdIQReHCcJgNd9XvTxSA'; img-src 'self'; style-src 'self' 'nonce-wdIQReHCcJgNd9XvTxSA'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' http://*.bankofamerica.com:* https://*.bankofamerica.com:*;

default-src 'self' *.bankofamerica.com *.bac-assets.com *.bofa.com *.ml.com https: wss: data: blob:; script-src 'self' *.bankofamerica.com *.bac-assets.com *.bofa.com *.ml.com fsa.merrilledge.com *.ml.wallst.com merrilledge.com s3.amazonaws.com boa-api.arkoselabs.com cdn.cookielaw.org resources.digital-cloud-bofa.medallia.com resources.digital-cloud.medallia.com players.brightcove.net metrics.brightcove.com cdnapisec.kaltura.com tags.tiqcdn.com akamai.tiqcdn.com glance.net beta.glancecdn.net storage.glancecdn.net cct.google cdn.mplxtms.com cdn.tt.omtrdc.net data.cmcore.com data.coremetrics.com iocdn.coremetrics.com libs.coremetrics.com mc.coremetrics.com mcdata.coremetrics.com mktgcdn.coremetrics.com recs.coremetrics.com secure-cdn.mplxtms.com convertro.com stage.convertro.com idsync.rlcdn.com test.coremetrics.com testdata.coremetrics.com tmscdn.coremetrics.com www.glancecdn.net www.google-analytics.com maps.googleapis.com www.googletagmanager.com mboxedge34.tt.omtrdc.net anrdoezrs.net cj.dotomi.com cj.com cj.mplxtms.com emjcd.com mczbf.com www.mczbf.com www.knotch-cdn.com sjwoe.com secure-cdn.mplxtms.com cdn.mplxtms.com bofa.demdex.net cdnstorage.myglance.net bankofamerica.tt.omtrdc.net www.paypalobjects.com cdn-bofa.myglance.net six.cdn-net.com vjs.zencdn.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' data: blob: *.bankofamerica.com *.bac-assets.com *.bofa.com *.ml.com cdn.cookielaw.org glance.net beta.glancecdn.net storage.glancecdn.net convertro.com stage.convertro.com *.ml.wallst.com idsync.rlcdn.com www.glancecdn.net cdnstorage.myglance.net www.google-analytics.com cdn-bofa.myglance.net resources.digital-cloud-bofa.medallia.com resources.digital-cloud.medallia.com 'unsafe-inline'; worker-src 'self' blob:; frame-ancestors 'self' *.bankofamerica.com *.ml.com *.bofa.com *.merrilledge.com;

default-src 'self'; style-src 'self' 'unsafe-inline' *.ml.com *.bankofamerica.com *.baml.com *.bluematrix.com *.thomsonreuters.com *.thomsonreuters.biz *.thomsonreuters.net *.sentieo.com *.refinitiv.com *.refinitiv.biz *.refinitiv.net *.fmrco.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.ml.com *.bankofamerica.com *.baml.com *.bluematrix.com *.thomsonreuters.com *.thomsonreuters.biz *.thomsonreuters.net *.sentieo.com *.refinitiv.com *.refinitiv.biz *.refinitiv.net *.fmrco.com; img-src 'self' data: 'unsafe-inline' *.ml.com *.bankofamerica.com *.baml.com *.bluematrix.com *.thomsonreuters.com *.thomsonreuters.biz *.thomsonreuters.net *.sentieo.com *.refinitiv.com *.refinitiv.biz *.refinitiv.net *.fmrco.com; connect-src 'self' 'unsafe-inline' wss: *.ml.com *.bankofamerica.com *.baml.com *.bluematrix.com *.thomsonreuters.com *.thomsonreuters.biz *.thomsonreuters.net *.sentieo.com *.refinitiv.com *.refinitiv.biz *.refinitiv.net *.fmrco.com; frame-src 'self' 'unsafe-inline' *.ml.com *.bankofamerica.com *.baml.com *.bluematrix.com *.thomsonreuters.com *.thomsonreuters.biz *.thomsonreuters.net *.sentieo.com *.refinitiv.com *.refinitiv.biz *.refinitiv.net *.fmrco.com; font-src 'self' 'unsafe-inline' data: *.ml.com *.bankofamerica.com *.baml.com *.bluematrix.com *.thomsonreuters.com *.thomsonreuters.biz *.thomsonreuters.net *.sentieo.com *.refinitiv.com *.refinitiv.biz *.refinitiv.net *.fmrco.com

5173d92e34cb9f89fbc64bd1cea80e8cc62b13b20b6d6e5b32938cd96415b619

4747f353c3bae7c961eca7ff40f0788d9f73093a58e300b655aa7f8bf2968d72

6221c1dde7159b6f032b4410d92bf93868b1ebc4b675e44397b9654ea62fec33

3f6d51f8e3846a25d605d8c2cd1f79137481c4672fd3dfb7efc4dcc99c9ccc85

b854d57ec35a143ea419f579d3a38c44f9291fe78075688e5caf0d0495b36c5c

e4ed9ada6133b3ab49d491c92b2e7bd6da2804642430f722843fb3bded82b8d2

96ebcebb3be128e2cdc7c01bea69a5315b407d690f2f3753d9b6525c617180e0

9bfd8689e648042e5777bcb8bc9412011bfc0033cda0bdc73bd621c5c603e116

666cd15050a8d8ffd64174eadb6c9a22b069dd2f911c61610a8da18fa37ad10c

f8e91ec84893a1ab67b0b5c11cd269d9513c7eea5475ca9e597e779544c29672

9eb38f49c160795d44429502e0ad34a1fa4b4ed5ad3cab4ef04339a2db503909

e81e7d08d34e0de6c42adfc36e7be982d22213a897b5d82b7629b96b7ce65432

313c07f6e4facc5730db27563c4aeaad1a86126333d448e47c7b29adb1f806fd

2485acaf90eb11c6ef8902487a9f980f3e6128c2b0a937c273c412527eb9c7cb

da6ed9cec64e37751ddaa1b2853e83e0d37a3f4c1418e51368b764b954b1eab0

d4194a6efd98555dfac838ab846c69a1e1cc1a7d035e7f47d7736142ffc41f2a

1ab081289ab2067da350970de519415a8dabe23aa49769e925b38f65ea1d9fc2

df488113adf4354c74da0e53bd8caba60500f5e07681e179fe5fc13a548e9691

1f4b4ef63196c4f8e64000c69b498195c3b1b64788d81df147e4f60adf05d912

0ed29e7774ebc5a0681ba604fd9d11ed7c5f5dc83913494f5fc10d3011a45327

0593c2dee85a2c97f36dc48afb321c9d14b2a723be04dc5fd963a286b00aacf2

e11dea736d977790e7fd9c6799b3eacd005ddfeea456543b00ea23f059bf13c1

viewport

default-src 'self' *.bankofamerica.com:* https://cdn.cookielaw.org https://geolocation.onetrust.com https://privacyportal-bofa.my.onetrust.com/ https://api.ipify.org; style-src 'self' *.bankofamerica.com:* 'nonce-iPaY4Y9OvzH7F78iuhLt'; img-src 'self' *.bankofamerica.com:* https://cdn.cookielaw.org data: ; script-src 'self' *.bankofamerica.com:* https://cdn.cookielaw.org https://api.ipify.org  blob: 'nonce-iPaY4Y9OvzH7F78iuhLt';

default-src 'self' https://*.bankofamerica.com https://privacyportal-bofa.my.onetrust.com; script-src 'self' https://*.bankofamerica.com https://cdn.cookielaw.org https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-HMZJA0vMxDNgN7fJhm9M'  ; script-src-elem 'self' https://*.bankofamerica.com https://cdn.cookielaw.org https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-HMZJA0vMxDNgN7fJhm9M'; style-src 'self' https://*.bankofamerica.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-HMZJA0vMxDNgN7fJhm9M' ;font-src 'self' https://*.bankofamerica.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com 'nonce-HMZJA0vMxDNgN7fJhm9M'; connect-src 'self' wss://*.bankofamerica.com https://*.bankofamerica.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://privacyportal-bofa.my.onetrust.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com; img-src 'self' data: https://*.bankofamerica.com https://cdn.cookielaw.org https://*.ml.com https://*.bac-assets.com https://*.ecnp.bankofamerica.com;  worker-src 'self' blob: https://*.bankofamerica.com; frame-src 'self' blob: https://*.bankofamerica.com https://*.highradius.com https://*.ml.com https://*.identrust.com https://*.digsigtrust.com; frame-ancestors 'self' https://*.bankofamerica.com https://*.highradius.com https://*.ml.com https://*.identrust.com https://*.digsigtrust.com

CSC Corporate Domains, Inc.

BANKOFAMERICA.COM

NOC United States

AIBV Hostmaster

Akamai International, BV

AIBV

(() => {
  const CSP_MEDIA_ATTR = 'ngCspMedia';
  const documentElement = document.documentElement;
  const listener = (e) => {
    const target = e.target;
    if (!target || target.tagName !== 'LINK' || !target.hasAttribute(CSP_MEDIA_ATTR)) {
     return;
    }
    target.media = target.getAttribute(CSP_MEDIA_ATTR);
    target.removeAttribute(CSP_MEDIA_ATTR);
    if (!document.head.querySelector(`link[ngCspMedia]`)) {
      documentElement.removeEventListener('load', listener);
    }
  };
  documentElement.addEventListener('load', listener, true);
})();


    var domainExp;
    if(ws != null){
      // post login flow
      domainExp="/*(.bankofamerica.com|.cashprobillpay(-[-a-zA-Z0-9]{2,10})?.com)(:[0-9]{4,5})?/";
    }
    else{
      // login flow
      domainExp="^https://(cashproonline|cptools)(-[-a-zA-Z0-9]{2,10})?\\.bankofamerica\\.com(:[0-9]{4})?/";
    }
    function checkDomain(exp) {
      var isValid = validateDomain(exp);
      if (isValid) {
          var clJack = document.getElementById("clJack");
            clJack.parentNode.removeChild(clJack);
      } else {
            //gis FIX - Cross site scripting issue fix- validating the location and then setting
         top.location = validateURL(self.location.href)?self.location:"";
      }
    }

    function validateURL(inputUrl) {
      var pattern = '^[a-zA-Z0-9_&amp;%?=+-/:.]+$';
      var check = inputUrl.match(pattern);
      if(check == null)
        return false;
      else
        return true;
    }

    function validateDomain(exp) {
      var rex = new RegExp(exp);
      var hst = location.protocol + "//" + location.host + "/";
      return self == top || document.referrer.indexOf(hst) == 0 || rex.test(document.referrer);
    }
    if(domainExp){
      checkDomain(domainExp);
    }
    else{
      checkDomain("/*(.bankofamerica.com|.cashprobillpay(-[-a-zA-Z0-9]{2,10})?.com)(:[0-9]{4,5})?/")
    }
  

Requests	IP Address	Location	AS Autonomous System
17	23.36.162.223	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
13	104.18.86.42	United States	AS13335Cloudflare, Inc.
13	171.159.116.200	United States	AS10794Bank of America, National Association
13	23.36.162.201	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
13	171.161.152.99	United States	AS10794Bank of America, National Association
69	5	-	-

Security Scan Report: online3.cashpro.bankofamerica.com

Summary

AI Security Verdict

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History