Skip to content
Live
Medium riskfirst seen 5 h ago

amērĭcanēxpress.ph

xn--amrcanxpress-xtbe00b.ph

68of 100

Credential phishing, aimed at bank customers. 96% likely a scam.

Copies American ExpressHosted in SingaporeNew domain

Why it was flagged

How the score works
  • Name and certificate
  • Registration and DNS
  • VAKYN verdict
  1. IDN "xn--amrcanxpress-xtbe00b" (amērĭcanēxpress) reads as "americanexpress", brand keyword "americanexpress"+48
  2. no mail servers, AS63949 AKAMAI-LINODE-AP Akamai Connected Cloud, same IP hosts 50 other flagged domain(s)+14
  3. 3 hyphens, 24-character name+5
  4. certificate covers only this name+1

Evidence

Registration

Hosting

Country
Singapore
Network
AKAMAI-LINODE-AP Akamai Connected Cloud
IP
45.79.222.138

DNS

A
45.79.222.138
MX
none

Certificate

Issuer
Let's Encrypt
Names
1
Seen
30 Oct 2026 04:57 UTC

VAKYN verdict

465 ms

Eight questions about the site, each with how sure the answer is.

  • Likely used for phishing or a scam?

    yes96% sure

    • yes96%
    • no4%

  • How dangerous for an ordinary visitor?

    Probably malicious49% sure

    • Probably malicious49%
    • Clearly malicious48%
    • Unclear3%

  • What is it most likely for?

    credential phishing38% sure

    • credential phishing38%
    • payment fraud37%
    • unclear7%

  • Which brand does it pretend to be?

    American Express81% sure

    • american express81%
    • none19%

  • Who is it aimed at?

    bank customers66% sure

    • bank customers66%
    • general public21%
    • shoppers10%

  • Would it ask visitors to sign in?

    yes50% sure

    • yes50%
    • no50%

  • Would it ask visitors to pay?

    yes73% sure

    • yes73%
    • no27%

  • Plausible innocent explanation?

    no97% sure

    • yes3%
    • no97%