amerilcanexprress[.]com

This domain, amerilcanexprress.com, poses a high-risk brand impersonation threat specifically targeting American Express customers. Analysis of the infrastructure reveals a fraudulent login portal designed to harvest credentials from unsuspecting users. The page title, "美國運通卡及美國運通信用卡| 美國運通," translates to "American Express Card and American Express Credit Card | American Express," directly mimicking the official brand to deceive Mandarin-speaking users. The domain lacks an SSL certificate, further indicating malicious intent, as legitimate financial services universally employ encryption for user protection. Evidence supporting the malicious classification includes detection by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. The domain was registered on December 2, 2025, through Dominet (HK) Limited, a registrar frequently associated with fraudulent activity. It resolves to the IP address 104.69.174.146, hosted on Akamai Technologies' infrastructure in Singapore (AS16625), a tactic often used to evade geofencing or appear more legitimate. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline, likely due to takedown efforts. Users who visited amerilcanexprress.com should assume their credentials were compromised. Immediate actions include resetting passwords for American Express accounts and any other services where the same credentials were reused. Enable multi-factor authentication (MFA) on all financial accounts to mitigate further risk. Monitor account statements for unauthorized transactions and report any suspicious activity to the legitimate financial institution. If personal or financial information was entered, consider placing a fraud alert or credit freeze with major credit bureaus to prevent identity theft. Given the domain's high-risk classification, affected users should remain vigilant for follow-up phishing attempts via email or SMS.