reservationcarbone[.]com

Analysis of reservationcarbone.com indicates a confirmed brand-impersonation phishing domain targeting American Express (Amex) customers. The domain was registered on November 7, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolved to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin infrastructure and leverage SSL encryption. The SSL certificate was issued by WE1, a provider often used in phishing campaigns for its low validation requirements.

The page title, 'Book Your Carbone Reservation Now on Resy,' suggests an attempt to impersonate a legitimate dining reservation service, likely to harvest credentials or payment details under the guise of an Amex-affiliated offer. The domain appears on one security blocklist and is flagged by two of 93 security vendors on VirusTotal, indicating moderate detection coverage. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. PhishDestroy has blocked the domain, and as of July 24, 2026, it is offline, though defenders should monitor for reactivation.

Defenders are advised to treat this domain as confirmed malicious infrastructure. The combination of a recent registration date, Cloudflare hosting, a low-trust SSL certificate, and explicit brand impersonation in the page title provides strong evidence of phishing intent. While the exact content of the site remains unanalyzed, the observable indicators align with known Amex phishing patterns. Organizations should update blocklists to include this domain and investigate any internal traffic that may have interacted with it prior to takedown.