If you landed on ww1.banksofamerica.com thinking it's Bank of America, look closer at the URL — it's missing the 'o' in 'bankofamerica'. This kind of typo-squatting is a classic trick to catch people off guard. The security certificate is invalid, meaning any data you send could be intercepted. Legitimate banks invest heavily in proper SSL and clear domain ownership; here the WHOIS record doesn't even show a registered domain, which is almost impossible for a real bank. The site also lacks a privacy policy, terms of service, and any verifiable contact method — all standard for online banking. It's already listed on a security blacklist, which confirms that other systems have flagged it as problematic. If you're asking yourself 'is ww1.banksofamerica.com a scam', the evidence says yes: it's set up to look like Bank of America but fails every basic trust check a real financial site passes automatically. Avoid sharing any information and report the site if you can.
No — ww1.banksofamerica.com doesn't look safe
In plain English
This site is a dangerous impersonation of Bank of America, using a typo-squatted domain and an invalid SSL certificate. There is no verifiable owner, the domain isn't even properly registered, and it's already on a blacklist. Do not enter any personal or financial information here.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site's SSL certificate is invalid and not even issued for this domain, which is a critical failure for any site handling sensitive information, especially one pretending to be a bank. Google Web Risk found no threats, but the certificate issue alone makes the connection untrustworthy.
The WHOIS record shows no match for this domain, meaning the domain either isn't properly registered or the registration data has been removed — unheard of for a legitimate financial institution. Combined with the typo-squatted name, the operator is deliberately hiding their identity.
The domain appears on a Barracuda blacklist, which means email or network security systems have flagged it as suspicious. While it has a three-year archive history, that doesn't outweigh the blacklist and the fact that it's impersonating a well-known bank.
There is an About page, which is positive, but the site provides no contact information, no social media links, and even a missing favicon. Real banks display their contact details prominently; this site's half-effort at transparency is a red flag.
No privacy policy or terms of service were found. For any website that asks for personal or financial data — and this site clearly aims to collect that — missing these legal pages is a serious regulatory and trust failure.
The site has SPF email authentication set up, which is good, but it lacks basic security headers, uses a cheap hosting provider in the British Virgin Islands, and has no DNSSEC. This is not the infrastructure of a legitimate bank.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.