americanexpress[.]vercel[.]app

This domain, americanexpress.vercel.app, operates as a brand impersonation threat specifically targeting American Express customers through a fraudulent login interface. Analysis confirms the page title as 'American Express Login,' indicating an attempt to harvest credentials under false pretenses. The domain is currently offline, though historical activity remains a concern for security teams. Infrastructure analysis reveals the domain was registered on January 28, 2020, through Vercel Inc. and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) infrastructure. Security vendors have flagged the domain, with 18 of 95 VirusTotal engines detecting malicious activity. The SSL certificate is issued by Google Trust Services (WR1), a common characteristic in phishing campaigns leveraging legitimate certificate authorities. The domain appears on one security blocklist, and Google Safe Browsing has explicitly classified it as phishing. While the domain is no longer active, organizations should treat any residual references with caution. Security teams are advised to update blocklists to include this domain and its associated IP address. End users who may have interacted with the site should be instructed to reset credentials immediately, particularly for financial accounts. Monitoring for similar patterns—such as Vercel-hosted subdomains impersonating financial institutions—can help preempt future threats.