Phishing sites impersonating Amex

PhishDestroy has recorded 81 phishing domains impersonating Amex since 2025-08-07, 11 of them in the last 30 days. The most used registrars are Dynadot and Trustname.com; the most common TLDs are .com and .shop. Open Amex only from its official app or a saved bookmark.

81
Domains, all time
11
Last 30 days
33
Online at last check
9
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 12026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 12026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 12026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 22026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 62026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 12026-10-03: 12026-10-04: 02026-10-05: 12026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 22026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 12026-10-17: 22026-10-18: 02026-10-19: 02026-10-20: 22026-10-21: 02026-10-22: 1
Amex phishing domains detected per day: 22 from 2026-07-25 to 2026-10-22; peak 6.

How to tell a fake Amex site

Words most often added to the brand in reported domains: aramex, txdmv, btc, aramexship, ellipaldesktop, everstakebot, bacb, ebaywallets, gas, slot.

  • Type the address yourself or use a bookmark; phishing links for Amex arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Amex does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Amex phishing domains

The 50 most recently detected domains impersonating Amex
DomainFirst detectedStatus at last checkRegistrar
amex.domaintoworkwith.net2026-10-22OnlineGname.com
bokstride.shop2026-10-20OfflineDynadot
boldcircuit.shop2026-10-20OfflineDynadot
bloomfold.shop2026-10-17OnlineDynadot
bleulane.shop2026-10-17OnlineDynadot
bfhome.shop2026-10-16OnlineDynadot
bandscostrapsspot.shop2026-10-11OnlineDynadot
amazingbdshop.com2026-10-11OnlineNAMECHEAP
pagoalcanos.top2026-10-05UnknownNICENIC
apecwaterhome.shop2026-10-03OnlineDynadot
apparatusstudiohq.shop2026-10-02OnlineDynadot
aramex.horroh.ink2026-09-09OfflineDominet (HK)
aramex.glassy.ink2026-09-09OfflineDominet (HK)
aramex.saddle.ink2026-09-09OfflineDominet (HK)
aramex.mqqztr.ink2026-09-09OfflineDominet (HK)
aramex.xknttx.ink2026-09-09OfflineDominet (HK)
aramex.buyerxx.xin2026-09-09OfflineDominet (HK)
cvvmarket.net2026-09-05OnlineTrustname.com
consultsur.com2026-09-05OfflinePublicDomainRegistry.com
painel-rastreio-jadlog.online2026-08-31OnlineDynadot
allupromo.online2026-08-24OnlineGoDaddy.com
uffizipass.com2026-07-30OnlineTrustname.com
americanxpresses.com2026-07-18OfflineUnstoppableUS3
skinbaronn.at2026-07-06Online—
glowshiya.com2026-06-19OnlineGoDaddy.com
exploramexicotours.com2026-06-15OnlineNeubox Internet de C.V
fynextrade.net2026-06-07OfflineCosmotown
skyscannerpromo.com2026-04-28OnlineTrustname.com
herpesmedsdirect.com2026-04-28OnlineTrustname.com
modafinilxl.net2026-04-24OnlineTrustname.com
zunrub.com2026-04-24OfflineTrustname.com
mercadomlseguro.com2026-04-21OfflineTucows Domains
verify.spacearn.com2026-04-21OfflineHOSTINGER operations
zumubs.com2026-04-21OfflineTrustname.com
zurnub.com2026-04-21OfflineTrustname.com
zumibi.com2026-04-21OfflineTrustname.com
skin-port.at2026-04-18Taken downHosting concepts / Registrar.eu ( https:
vipleaks.xyz2026-04-18OnlineOwnRegistrar
internationalcannabisclub.com2026-04-13OfflineGoDaddy.com
apkcraft.pages.dev2026-04-07OnlineCloudflare
ellipaldesktop.store2026-03-18OnlineNICENIC
login.wbfinance.us2026-02-28OfflineRegistrar.eu
txdmv.akdyn.cc2026-02-26Offline—
txdmv.uylfz.cc2026-02-26Offline—
reservationcarbone.com2026-02-26OfflineDominet (HK)
dynamexlogistixcargo.com.nuviab.com2026-02-26OfflineDynadot
txdmv.bcsgh.cc2026-02-26Offline—
nexivolt-al94.com2026-02-26Offline—
txdmv.pvfxm.cc2026-02-26Offline—
txdmv.ptxnm.cc2026-02-26Offline—

All 81 Amex reports

Where they are registered and hosted

Registrars

  1. Dynadot14
  2. Trustname.com9
  3. Dominet (HK)8
  4. Dynadot8
  5. Cloudflare3
  6. GoDaddy.com3
  7. Global Domain2
  8. Registrar.eu2

Top-level domains

  1. .com41
  2. .shop8
  3. .cc5
  4. .ink5
  5. .net4
  6. .fr2
  7. .uk2
  8. .app2

Hosting networks

  1. CLOUDFLARENET - Cloudflare, Inc., US23
  2. CLOUDFLARENET, US10
  3. Cloudflare, Inc.10
  4. malakmadze Malakmadze Web LLC, GE6
  5. AS-COLOCROSSING, US4
  6. Amazon.com, Inc.3
  7. Hostinger International Limited3
  8. Malakmadze Web LLC2

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Amex; share of all PhishDestroy reports: 0.04%.