American Express

Cards United Statesamericanexpress.comRank 30 of the most impersonated
Cert findings · 24 h
0
Cert findings · 7 days
6
5 reported or listed · 1 on phishing hosts
Registered lookalikes
115
7 listed by a source or an address list
Official domains
56
verified from American Express's own sites and records

Certificate findings for American Express

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to American Express's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 7 findings, grouped by hostname

  1. djscd.com US · AS62904 · Eonix Corporation
    ListedListed by JPCERT/CC as imitating American ExpressMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    djscd.com
    First seen
    2026-11-03 06:36 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    JPCERT/CC confirmed it 2026-06-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 02:09 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 05:32 UTC to 2027-02-01 06:29 UTC
    Logged 2026-11-03 06:32 UTC in IPng Networks Gouda2027h1, entry 299,736,507
    SHA-256 d9abb7a8b54c6499e70cb50ec480bcad30ab0449af4d521808e75246e030cded
    Public key SHA-256 9b3df757d851951795c69d181c1f797c27bcfe6282576ef8c71cc299729ef42d
    Brand
    American Express
    Addresses
    50.2.135.251 · United States · AS62904 AS62904 - Eonix Corporation
    Domain
    djscd.com
    Registered
    2026-09-02 · Gname 434 Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  2. a-posteriori.com US · AS14618 · Amazon.com, Inc.2 addresses
    ListedParking page · HugeDomainsListed by JPCERT/CC as imitating American ExpressMX absentSPF -allDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    a-posteriori.com
    First seen
    2026-11-02 14:05 UTC
    First published
    2026-11-02 14:21 UTC
    Listing
    JPCERT/CC confirmed it 2026-08-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 02:09 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 13:05 UTC to 2027-01-31 13:05 UTC
    Logged 2026-11-02 14:04 UTC in Let's Encrypt Willow2027h1, entry 897,312,850
    SHA-256 1990f1b6919bbdbacdceb097c02428ad0b27a816c2fc20c294c7972a9657a32a
    Public key SHA-256 2f0e148f3350c479dc3e755963bae513ad6b6aef86d562e8c79c04d170fefe07
    Brand
    American Express
    Addresses
    13.223.25.84 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    54.243.117.197 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    Parking page · HugeDomains
    HugeDomains (13.223.25.84, 54.243.117.197): a parking service. It answers for names that are typically for sale or unused.
    Domain
    a-posteriori.com
    Registered
    2026-11-02 · DropCatch.com 1364 LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  3. american-express.tokyo JP · AS7684 · SAKURA Internet Inc.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF all omittedDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    american-express.tokyo
    First seen
    2026-11-02 06:46 UTC
    First published
    2026-11-02 06:52 UTC
    DNS
    Resolves · checked 2026-11-05 07:03 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 133.125.148.6.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 133.125.148.6
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-02 05:44 UTC to 2027-01-31 05:44 UTC
    Logged 2026-11-02 06:42 UTC in Google PlumbersArms2027h1, entry 567,795,171
    SHA-256 ba2e4780f2db4df116741988257c42e80c898ef14a9c478324917532dd88c7e3
    Public key SHA-256 1387cd60c877aa26297c8e3728c20d2d511fafef8d7b841518e944cbd212c520
    Brand
    American Express
    Addresses
    133.125.148.6 · Japan · AS7684 SAKURA-A - SAKURA Internet Inc.
    Domain
    american-express.tokyo
    Registered
    2018-02-06 · GMO Internet Group, Inc.
    MX
    Receives mail at american-express.tokyo
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  4. americanexpress.verifizierung-online.com SE · AS30893 · NOACKHOSTING-AS No ACK Grou…
    ListedUnder verifizierung-online.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 54 d ago
    DetailsHide
    Hostname
    americanexpress.verifizierung-online.com
    First seen
    2026-11-01 23:36 UTC
    First published
    2026-11-01 23:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:06 UTC
    Listed
    MetaMask, listing verifizierung-online.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-01 22:34 UTC to 2027-01-30 22:34 UTC
    Logged 2026-11-01 23:32 UTC in Let's Encrypt Sycamore2027h1, entry 894,123,919
    SHA-256 15d0f79cf2825701262ce718e7ed6168f372e4f9469ca0eade985fc054b58230
    Public key SHA-256 7d1d0021e70f7be5f0a7532274ab01a1d096bd512b431f3d805136f31bc7a617
    Brand
    American Express
    Addresses
    150.40.98.37 · Sweden · AS30893 NOACKHOSTING-AS No ACK Group Holding AB
    Domain
    verifizierung-online.com
    Registered
    2026-09-12 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  5. woaiys.com
    ListedListed by JPCERT/CC as imitating American ExpressMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    woaiys.com
    First seen
    2026-10-31 15:16 UTC
    First published
    2026-10-31 16:11 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 02:09 UTC
    DNS
    Resolves · checked 2026-11-04 16:20 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 14:15 UTC to 2027-01-29 14:15 UTC
    Logged 2026-10-31 15:13 UTC in Google PlumbersArms2027h1, entry 541,388,546
    SHA-256 86d9b94ded15be4595c01da31eaf8eebcddd66c3630c66548c6ada434f450fbd
    Public key SHA-256 173cfc71955fde8fe2cfac459bfc61790cbbe94273f2cb4e9ccedbb2792f3666
    Brand
    American Express
    Domain
    woaiys.com
    Registered
    2024-10-05 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  6. jqqgo.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by JPCERT/CC as imitating American ExpressMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    jqqgo.com
    First seen
    2026-10-29 13:26 UTC
    First published
    2026-10-29 14:18 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-03 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 02:09 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 12:24 UTC to 2027-01-27 13:23 UTC
    Logged 2026-10-29 13:24 UTC in Let's Encrypt Willow2027h1, entry 833,123,383
    SHA-256 d9c781706576080ab3645faf99470dead8480f02f485c33022a63cd6ef1ebfde
    Public key SHA-256 90d6491e1245335df43e5a46561b51c998a93254b69094a29ab351eb9465f06e
    Brand
    American Express
    Addresses
    104.21.22.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.206, 172.67.206.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jqqgo.com
    Registered
    2026-01-01 · Xiamen Nawang Technology Co., Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:42 UTC

    Suggest a correction

  7. gda1iy.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by JPCERT/CC as imitating American ExpressMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    gda1iy.info
    First seen
    2026-10-29 10:46 UTC
    First published
    2026-10-29 10:53 UTC
    Listing
    JPCERT/CC confirmed it 2026-08-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 02:09 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-29 10:33 UTC to 2027-01-24 10:26 UTC
    Logged 2026-10-29 10:43 UTC in DigiCert Wyvern2027h1, entry 346,478,213
    SHA-256 2f3d13c32c2f1c2949b069688b0c286d8631acf224737ef991d2a48545c78dab
    Public key SHA-256 d7ac4bc0084caa252c14ea033c43b8fb662e5f095b47a1fe834eea770d32b966
    Brand
    American Express
    Addresses
    104.21.1.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.1.224, 172.67.152.101): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gda1iy.info
    Registered
    2025-11-15 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:42 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches American Express when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Cards

All brands →