americanexpress-dez03[.]ink

americanexpress-dez03.ink is a confirmed phishing domain that specifically targets American Express customers. The site was designed to impersonate legitimate American Express login pages, aiming to steal sensitive credentials such as usernames, passwords, and possibly financial information. The domain is currently offline, but while active it posed a significant threat to users who might have been tricked into entering their personal data.

The evidence against this domain is substantial. VirusTotal flagged it as malicious by 17 out of 95 security vendors, indicating broad consensus among cybersecurity tools. The domain was registered through Dominet (HK) Limited and created on April 01, 2026, which is notably a future date, suggesting possible data manipulation or an error. It resolves to IP address 43.159.168.186 and uses an SSL certificate issued by Let's Encrypt (E7), which gives it a false sense of legitimacy. The domain appeared on 1 security blocklist before being taken offline, and its page title was 'Error 524 - A timeout occurred', likely a placeholder or a result of takedown efforts.

Users who visited americanexpress-dez03.ink should immediately change their American Express account passwords and enable two-factor authentication if available. They should also monitor their financial statements for any unauthorized transactions and report any suspicious activity to American Express. Additionally, running a full malware scan on their devices is recommended, as phishing sites sometimes deliver malware. PhishDestroy advises users to always verify URLs before entering sensitive information and to avoid clicking on links in unsolicited emails or messages.