WEBSITE ANALYSIS REPORT

http://amex.domaintoworkwith.net/

22 Oct 2026 · 13:08:44.000 UTCpublic

Report tags: american_express financial phishing
Submit tags

Request review

Phishing detected

6 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

13:08:13.525 GET 200 document 1.0 KB 152 ms 5 alerts

Transaction #21

Request / response

URL

GET HTTPS

https://amex.domaintoworkwith.net/

IP / ASN

92.118.230.185

AS44477 · Stark Industries Solutions Ltd

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text, with CRLF, CR, LF line terminators
MIME type: text/html
First seen (UTC): 22 Oct 2026 · 05:54:51.155 UTC
Last seen (UTC): 22 Oct 2026 · 13:08:47.253 UTC
Times seen: 3

Size: 1.0 KB (1056 bytes)
MD5: 3f9cbd3fb166a7bde3f4701c1363a016
SHA1: 75685c3a6e0257e9fe875fd889a6fd740c27afe8
SHA256: 13df781e40c1d07d1b7506f854d38068bbaff29fd20f4ad02a4f9191ff705a92

Certificate information

Issuer: Let's Encrypt · YE2
Subject: amex.domaintoworkwith.net
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 3D:85:BA:35:99:35:43:C7:4B:28:80:8D:73:AF:12:E0:9D:E9:AA:6C
Valid from: Tue, 20 Oct 2026 20:46:12 GMT
Valid until: Mon, 18 Jan 2027 20:46:11 GMT

Technology fingerprints

Nginx:1.27.5 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - American Express	medium	Phishing
Cloudflare DNS Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing
DNS4EU Sinkholed	medium	Malicious
CIRA Canadian Shield DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET / HTTP/1.1
Host: amex.domaintoworkwith.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
content-encoding: gzip
content-type: text/html
date: Thu, 22 Oct 2026 13:08:13 GMT
etag: W/"6ad7e02b-420"
last-modified: Tue, 20 Oct 2026 21:42:03 GMT
server: nginx/1.27.5
X-Firefox-Spdy: h2

13:08:14.358 GET 200 stylesheet 343.6 KB 47 ms —

13:08:14.361 GET 200 script 124.0 KB 42 ms 5 alerts

13:08:14.364 GET 200 script 217.8 KB 122 ms 5 alerts

13:08:14.365 GET 200 stylesheet 474.5 KB 120 ms 5 alerts

13:08:14.659 GET 200 fetch 49 B 42 ms 5 alerts

13:08:14.711 GET 200 img 1.3 KB 85 ms —

13:08:14.746 GET 200 imageset 46.9 KB 43 ms —

13:08:14.758 GET 200 img 7.2 KB 27 ms —

13:08:14.761 GET 200 img 4.0 KB 118 ms —

13:08:14.781 GET 200 img 22.3 KB 26 ms —

13:08:14.791 GET 200 img 43.3 KB 40 ms —

13:08:14.801 GET 200 img 1.6 KB 45 ms —

13:08:14.808 GET 200 img 79.0 KB 35 ms —

13:08:14.817 GET 200 img 45.1 KB 28 ms —

13:08:14.819 GET 200 img 93.5 KB 110 ms —

13:08:14.829 GET 200 img 98.7 KB 24 ms —

13:08:14.839 GET 200 img 91.0 KB 23 ms —

13:08:14.997 GET 200 font 68.1 KB 37 ms —

13:08:15.003 GET 200 font 36.3 KB 39 ms —

13:08:15.232 GET 200 img 2.3 KB 22 ms —

13:08:15.262 GET 200 font 20.9 KB 19 ms —

13:08:15.266 GET 200 img 1.6 KB 16 ms —

13:08:15.272 GET 200 img 1.6 KB 29 ms —

13:08:15.275 GET 200 img 1.6 KB 26 ms —

13:08:15.277 GET 200 img 5.5 KB 25 ms —

13:08:22.790 GET 200 img 10.4 KB 24 ms —

13:08:22.794 GET 200 img 2.9 KB 35 ms —

13:08:22.799 GET 200 img 66.0 KB 22 ms —

13:08:30.801 GET 200 img 8.7 KB 30 ms —

13:08:30.806 GET 200 img 93.5 KB 24 ms —

http://amex.domaintoworkwith.net/

Domain graph

Hostnames

Connections

Network requests

Transaction #21

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://amex.domaintoworkwith.net/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #21

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://amex.domaintoworkwith.net/

Domain graph

Network requests