americanexpress-de27[.]ink

This domain, americanexpress-de27.ink, is identified as a credential theft operation impersonating American Express, a major financial services provider. Analysis indicates the site was designed to mimic legitimate American Express login portals, tricking users into submitting sensitive account credentials, including usernames, passwords, and potentially multi-factor authentication codes. The infrastructure shows no direct ties to known cryptocurrency drainer kits, focusing instead on harvesting financial account access for subsequent unauthorized transactions or identity theft. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited on April 03, 2026, an atypical creation date suggesting potential backdating or future-dated abuse. It resolves to the IP address 43.159.168.186, a host with prior associations to malicious activity. The domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, indicating moderate consensus on its malicious nature. No confirmation of inclusion in Google Safe Browsing databases was observed at the time of assessment. The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. Despite its inactive status, residual risk remains for users who may have interacted with the site before its deactivation. Organizations are advised to monitor for unauthorized access attempts linked to credentials potentially compromised via this domain. Network defenders should update blocklists to include the domain and associated IP address, while users should be alerted to verify the authenticity of any communication purporting to be from American Express, particularly those directing to non-official domains.