americanxpresses[.]com

This domain, americanxpresses.com, is flagged as an active phishing threat targeting American Express users, based on its naming pattern and confirmed security vendor classifications. Registered on July 16, 2026, through UnstoppableUS3 LLC, the domain resolves to IP address 92.205.27.200 and uses nameservers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. Analysis indicates a high-risk classification due to detection by 21 of 91 security vendors and inclusion in Google Safe Browsing’s SOCIAL_ENGINEERING category. The domain appears in one threat intelligence pulse on AlienVault OTX, reinforcing its association with malicious activity. Defenders should note the recent registration date and the use of a domain registrar commonly linked to phishing infrastructure. While the exact content of the site has not been analyzed, the combination of technical indicators and vendor detections strongly suggests it is actively used for credential harvesting or fraudulent transactions. Immediate blocking of the domain and its resolving IP is recommended, along with monitoring for related subdomains or redirects. Further investigation into the hosting provider and associated network infrastructure may reveal additional compromised assets or threat actor patterns.