~/d/bankofamerica.com

> dossier for bankofamerica.com

an at-a-glance snapshot. each section streams in independently.

## dns[ok]

open standalone →

A: ttl=576 3.173.21.90
ttl=576 3.173.22.90
ttl=576 3.173.23.90
AAAA: —
NS: ttl=20446 f.ns-boa.us.
ttl=20446 a.ns-bac.com.
ttl=20446 c.ns-bac.net.
ttl=20446 d.ns-bac.info.
ttl=20446 b.ns-bac.org.
ttl=20446 e.ns-boa.biz.
ttl=20446 g.ns-bac.com.
SOA: ttl=423 ns10.bac.com. domain\.administrator.bankofamerica.com. 2026043410 1800 900 604800 600
CAA: ttl=249 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=249 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=249 \# 15 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67
ttl=249 \# 18 00 05 69 73 73 75 65 73 65 63 74 69 67 6f 2e 63 6f 6d
ttl=249 \# 14 00 05 69 73 73 75 65 73 73 6c 2e 63 6f 6d
ttl=249 \# 22 00 08 69 73 73 75 65 76 6d 63 64 69 67 69 63 65 72 74 2e 63 6f 6d
TXT: ttl=2376 "00D2g0000000ZPI=1TBD1000000003M"
ttl=2376 "onetrust-domain-verification=e788a6ac2ccb43818ec10f692be6c065"
ttl=2376 "00DHo000007ESQH=1TBHo000000sXtb"
ttl=2376 "MS=ms26780064"
ttl=2376 "00D30000001HRSt=1TBKe000000blLi"
ttl=2376 "00Dd0000000fllf=1TBKh000000Kynr"
ttl=2376 "00DDn0000014WMF=1TBDn0000000006"
ttl=2376 "00D0b000000De84=1TBKW000000GmaA"
ttl=2376 "00DDY0000000PuC=1TBDY0000004C9D"
ttl=2376 "00DDn00000122RU=1TBDn0000004C9E"
ttl=2376 "webexdomainverification.KK48=150225ca-a113-4206-9228-4e3460b52486"
ttl=2376 "00D30000001H1Cv=1TBHt000000000B"
ttl=2376 "webexdomainverification.=9caf3cdf-4b7a-4806-8346-9a9591002ef3"
ttl=2376 "00D46000000aATr=1TBKk0000000007"
ttl=2376 "00D300000005zGi=1TBKe000000oLob"
ttl=2376 "webexdomainverification.DMQQ=2397072c-14ba-446b-af2b-b7d82b0c3d84"
ttl=2376 "webexdomainverification.D182=d3bd60b7-b138-488e-9ce4-bb6a965bd46c"
ttl=2376 "webexdomainverification.AU51=01da9742-a899-4543-b134-6dba5c7669f0"
"00D3000000071D4=1TBKX0000008OLJ"

fetched 2026-04-24T08:04:54.282Z

## dns[not_applicable]

open standalone →

resolving…

## mx[ok]

open standalone →

pri=10 mxa-0000ec05.gslb.pphosted.com.
pri=10 mxb-0000ec05.gslb.pphosted.com.

fetched 2026-04-24T08:04:54.283Z

## mx[not_applicable]

open standalone →

resolving mx…

## spf[ok]

open standalone →

v=spf1 ip4:171.161.41.178 ip4:171.159.227.167 ip4:171.161.147.155 include:spf-0000ec15.pphosted.com ~all

v=spf1
ip4:171.161.41.178
ip4:171.159.227.167
ip4:171.161.147.155
include:spf-0000ec15.pphosted.com
~all

fetched 2026-04-24T08:04:54.324Z

## spf[not_applicable]

open standalone →

resolving spf…

## dmarc[ok]

open standalone →

v=DMARC1; p=reject; fo=1; rua=mailto:auth.report_ns@bankofamerica.com; ruf=mailto:bankofamerica@ruf.agari.com

v=: DMARC1
p=: reject
fo=: 1
rua=: mailto:auth.report_ns@bankofamerica.com
ruf=: mailto:bankofamerica@ruf.agari.com

fetched 2026-04-24T08:04:54.285Z

## dmarc[not_applicable]

open standalone →

resolving dmarc…

## dkim[not_applicable]

open standalone →

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

## dkim[not_applicable]

open standalone →

probing dkim selectors…

## tls[ok]

open standalone →

subject cn:: bankofamerica.com
issuer:: DigiCert EV RSA CA G2 / DigiCert Inc
valid:: Sep 16 00:00:00 2025 GMT → Sep 15 23:59:59 2026 GMT
authorized:: yes
sha256:: 02:C1:AD:CF:68:F4:6B:56:F1:04:B9:FE:00:A9:A3:ED:31:D3:1A:08:49:7B:E4:39:B0:C1:B1:54:80:83:8A:C8
sans: bankofamerica.com

fetched 2026-04-24T08:04:54.274Z

## tls[not_applicable]

open standalone →

fetching tls cert…

## redirects[ok]

open standalone →

final status: 200 · 2 hops

[301] https://bankofamerica.com/
[200] https://www.bankofamerica.com/

fetched 2026-04-24T08:04:54.360Z

## redirects[not_applicable]

open standalone →

tracing redirects…

## headers[ok]

open standalone →

final url: https://www.bankofamerica.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self' *.bankofamerica.com *.bac-assets.com *.ml.com https: wss: data: blob:; script-src 'self' *.bankofamerica.com *.bac-assets.com *.ml.com fsa.merrilledge.com merrilledge.com s3.amazonaws.com boa-api.arkoselabs.com cdn.cookielaw.org resources.digital-cloud.medallia.com players.brightcove.net metrics.brightcove.com cdnapisec.kaltura.com tags.tiqcdn.com akamai.tiqcdn.com glance.net beta.glancecdn.net storage.glancecdn.net cct.google cdn.mplxtms.com cdn.tt.omtrdc.net data.cmcore.com data.coremetrics.com iocdn.coremetrics.com libs.coremetrics.com mc.coremetrics.com mcdata.coremetrics.com mktgcdn.coremetrics.com recs.coremetrics.com secure-cdn.mplxtms.com convertro.com stage.convertro.com idsync.rlcdn.com test.coremetrics.com testdata.coremetrics.com tmscdn.coremetrics.com glancecdn.net www.glancecdn.net www.google-analytics.com maps.googleapis.com www.googletagmanager.com mboxedge34.tt.omtrdc.net anrdoezrs.net cj.dotomi.com cj.com cj.mplxtms.com emjcd.com mczbf.com sjwoe.com secure-cdn.mplxtms.com cdn.mplxtms.com bofa.demdex.net cdnstorage.myglance.net bankofamerica.tt.omtrdc.net www.paypalobjects.com cdn-bofa.myglance.net six.cdn-net.com vjs.zencdn.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' data: blob: *.bankofamerica.com *.bac-assets.com *.ml.com cdn.cookielaw.org glance.net beta.glancecdn.net storage.glancecdn.net convertro.com stage.convertro.com idsync.rlcdn.com glancecdn.net www.glancecdn.net cdnstorage.myglance.net www.google-analytics.com cdn-bofa.myglance.net resources.digital-cloud.medallia.com 'unsafe-inline'; worker-src 'self' blob:; frame-ancestors 'self' *.bankofamerica.com *.ml.com *.merrilledge.com;
x-frame-options: SAMEORIGIN
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-origin: https://secure.bankofamerica.com
access-control-expose-headers: SMIDENTITY, Uniq_session_id, device-type, csrfToken, gatewayCSRFToken
access-control-max-age: 3600
akamai-request-bc: [a=23.52.15.70,b=254604704,c=g,n=US_VA_ASHBURN,o=20940]
cache-control: max-age=1
connection: keep-alive
content-encoding: gzip
content-length: 49911
content-type: text/html
date: Fri, 24 Apr 2026 08:04:54 GMT
etag: "4bbe9-64f9ce34d1933"
expires: Fri, 24 Apr 2026 08:04:50 GMT
last-modified: Fri, 17 Apr 2026 00:18:27 GMT
set-cookie: WPID=C1S2; Domain=.bankofamerica.com; Path=/
vary: Accept-Encoding
x-bac-akm-c: ON
x-boa-affinity_cookie: WPID=C1S2; Domain=.bankofamerica.com; Path=/
x-boa-requestid: aeskIfbY5h-eKx5b-4afeAAAAJs

fetched 2026-04-24T08:04:54.357Z

## headers[not_applicable]

open standalone →

fetching headers…

## cors[ok]

open standalone →

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-04-24T08:04:54.300Z

## cors[not_applicable]

open standalone →

sending preflight…

## web-surface[ok]

open standalone →

robots.txt

present

User-agent: *             # applies to all robots
Disallow: /global         # disallow indexing of restricted areas
Disallow: /cfdocs
Disallow: /thirdparty
Disallow: /directbenefits
Disallow: /groupbanking
Disallow: /incubator
Disallow: /signin
Disallow: /associatebanking
Disallow: /cgi-bin
Disallow: /deposits/*.pdf$
Disallow: /deposits/*.swf$
Disallow: /deposits/*.txt$
Disallow: /products/deposits/
Disallow: /banking-information/associatebanking/
Disallow: /banking-information/employeebanking/
Disallow: /products/employeebanking/
Disallow: /employeebanking
Disallow: /employeebankingandinvestments
Disallow: /*slider-module.go
Disallow: */hp-assets/
Disallow: /financial-wellness/    

# Disallow URLs with tracking parameters
Disallow: /adtrack/
Disallow: /*adlink
Disallow: /*cm_mmc
Disallow: /weblinking/
Disallow: /mortgage_network/
Disallow: /*cm_sp
Disallow: /*reason=QKN
Disallow: /*msg=OnlineIdEmpty
Disallow: /*SOURCE_URL

# Disallow mobile content
Disallow: /promos/jump/package/iPhone/
Disallow: /promos/jump/package/mobile/

User-agent: gsa-crawler  # Special rule just for Google Search Appliance
Disallow: /global
Disallow: /cfdocs
Disallow: /thirdparty
Disallow: /directbenefits
Disallow: /groupbanking
Disallow: /incubator
Disallow: /signin
Disallow: /cgi-bin
Disallow: /deposits/*.pdf$
Disallow: /deposits/*.swf$
Disallow: /deposits/*.txt$
Disallow: /products/deposits/
Disallow: /banking-information/associatebanking/
Disallow: /banking-information/employeebanking/
Disallow: /products/employeebanking/
Disallow: /employeebanking
Disallow: /employeebankingandinvestments
Disallow: /*slider-module.go
Disallow: */hp-assets/
Disallow: /financial-wellness/  

# Disallow URLs with tracking parameters
Disallow: /adtrack/
Disallow: /*adlink
Disallow: /*cm_mmc
Disallow: /weblinking/
Disallow: /mortgage_network/
Disallow: /*cm_sp
Disallow: /*reason=QKN
Disallow: /*msg=OnlineIdEmpty
Disallow: /*SOURCE_URL

# Disallow mobile content
Disallow: /promos/jump/package/iPhone/
Disallow: /promos/jump/package/mobile/

User-agent: OmniExplorer_Bot
Disallow: /

# Allow mobile content for primary mobile bots

User-agent: Googlebot-Mobile
User-agent: msnbot-mobile
User-agent: YahooSeeker/M1A1-R2D2
Disallow: /global
Disallow: /cfdocs
Disallow: /thirdparty
Disallow: /directbenefits
Disallow: /groupbanking
Disallow: /incubator
Disallow: /signin
Disallow: /associatebanking
Disallow: /cgi-bin
Disallow: /deposits/*.pdf$
Disallow: /deposits/*.swf$
Disallow: /deposits/*.txt$
Disallow: /products/deposits/
Disallow: /banking-information/associatebanking/
Disallow: /banking-information/employeebanking/
Disallow: /products/employeebanking/
Disallow: /employeebanking
Disallow: /employeebankingandinvestments
Disallow: /*slider-module.go
Disallow: */hp-assets/
Disallow: /financial-wellness/  

# Disallow URLs with tracking parameters
Disallow: /adtrack/
Disallow: /*adlink
Disallow: /*cm_mmc
Disallow: /weblinking/
Disallow: /mortgage_network/
Disallow: /*cm_sp
Disallow: /*reason=QKN
Disallow: /*msg=OnlineIdEmpty
Disallow: /*SOURCE_URL

sitemap: https://www.bankofamerica.com/content/sitemap_index.xml

#Deployed from SPARTA
#CAST ID for this deployment #78658
#www robots.txt

sitemap.xml

absent

head

title: Bank of America - Banking, Credit Cards, Loans and Merrill Investing
description: What would you like the power to do? At Bank of America, our purpose is to help make financial lives better through the power of every connection.

social

og:title: Bank of America - Banking, Credit Cards, Loans and Merrill Investing
og:description: What would you like the power to do? At Bank of America, our purpose is to help make financial lives better through the power of every connection.
og:type: website
og:site_name: Bank of America
og:url: https://www.bankofamerica.com/
og:image: https://www.bankofamerica.com/content/images/ContextualSiteGraphics/Logos/en_US/logos/colored_flagscape-v2.png
og:image:alt: Bank of America - Banking, Credit Cards, Loans and Merrill Investing
twitter:title: Bank of America - Banking, Credit Cards, Loans and Merrill Investing
twitter:description: What would you like the power to do? At Bank of America, our purpose is to help make financial lives better through the power of every connection.
twitter:card: summary
twitter:site: @BankofAmerica
twitter:url: https://www.bankofamerica.com/
twitter:image: https://www.bankofamerica.com/content/images/ContextualSiteGraphics/Logos/en_US/logos/colored_flagscape-v2.png
twitter:image:alt: Bank of America - Banking, Credit Cards, Loans and Merrill Investing

fetched 2026-04-24T08:04:54.600Z

## web-surface[not_applicable]

open standalone →

inspecting web surface…