amexoun[.]izumi-taten[.]com

This domain, amexoun.izumi-taten.com, is a credential theft operation targeting American Express customers. The site mimics legitimate login portals to harvest account credentials, including usernames, passwords, and potentially multi-factor authentication codes. Victims who enter their details risk unauthorized account access, financial fraud, and identity theft. The threat is particularly dangerous due to its targeted impersonation of a trusted financial institution, increasing the likelihood of user deception. Analysis indicates the domain was registered on December 24, 2025, through Aceville Pte. Ltd., a registrar with a history of hosting malicious infrastructure. The site lacks an SSL certificate, a critical red flag for any financial service impersonation. At the time of detection, 22 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The domain resolved to IP address 158.51.96.53, hosted by NetInformatik Inc. (AS397270) in the United States, a network previously associated with phishing campaigns. If you visited amexoun.izumi-taten.com and entered credentials, take immediate action. First, change your American Express password and enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions and report suspicious activity to American Express fraud teams. Consider placing a fraud alert or credit freeze with major credit bureaus to mitigate potential identity theft. Avoid reusing the compromised password on other platforms, and scan your device for malware using updated security tools. Organizations should block the domain and its associated IP (158.51.96.53) at the network level to prevent further exposure.