{"report_id":"8c30c5fd-e04e-4fab-80c2-b849d2b9f02e","version":0,"status":"done","tags":["american_express","financial","phishing"],"date":"2026-07-18T17:10:41Z","url":{"schema":"http","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":0,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"title":"Log In to My Account | American Express US","dom":{"size":316366,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (47949)","md5":"74d9e543bc3b75d5786d488222e57e60","sha1":"7550c8938de552b00c8ebeb0fd6178752e3aac74","sha256":"9cc73d741a4ecc8003b3fbf6acc2e9a0c482bdbad76de20c8ce425c5ab81f834","sha512":"a828ca27a62cc916dde2858c70b09a73b89d10cfd17c1a1303c7d7420d6ed817964725e1d991b2c657fcce4a8ec3281402fd47d87b63aabdc54b1b7654708a01","ssdeep":"3072:MwhaBAUC2g73KwhaB7ZgltSybITWv+S3OgJRpWh:MwhaBAP2gLKwhaB26VKtbRYh","tlshash":"066420e993f5662f427a399ef9423909ef9901ae441e2db3f70ee58e1dc164347f2204","dom_hash":"domhash998b060149bb7b3821568a7bc3dc6c06","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":0,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T17:10:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"lptag.liveperson.net","ip":{"addr":"178.249.97.23","port":443,"asn":11054,"as":"LIVEPERSON","country":"United States","country_code":"US"},"domain_registered":"1999-01-14","domain_rank":27950,"first_seen":"2012-08-02T18:15:51Z","last_seen":"2026-07-15T12:17:45.935977Z","alert_count":0,"request_count":1,"received_data":30099,"sent_data":480,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"omns.americanexpress.com","ip":{"addr":"63.140.62.236","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"1995-06-04","domain_rank":92556,"first_seen":"2015-05-30T13:42:26Z","last_seen":"2026-07-14T06:21:40.199667Z","alert_count":0,"request_count":1,"received_data":738,"sent_data":682,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"icm.aexp-static.com","ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2010-10-07","domain_rank":109759,"first_seen":"2014-03-19T13:44:33Z","last_seen":"2026-07-17T00:27:21.247802Z","alert_count":0,"request_count":1,"received_data":1301,"sent_data":499,"comment":"","tags":null,"fingerprints":[{"name":"Akamai","description":"Akamai is global content delivery network (CDN) services provider for media and software delivery, and cloud security solutions.","website":"https://akamai.com","common_platform_enumeration":"","icon":"Akamai.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Akamai Bot Manager","description":"Akamai Bot Manager detect bots using device fingerprinting bot signatures.","website":"https://www.akamai.com/us/en/products/security/bot-manager.jsp","common_platform_enumeration":"","icon":"Akamai.svg","categories":["Security"]}]},{"fqdn":"origin-pqgemapp.americanexpress.com","ip":{"addr":"12.29.101.63","port":443,"asn":6307,"as":"AMERICAN-EXPRESS","country":"United States","country_code":"US"},"domain_registered":"1995-06-04","domain_rank":4610989,"first_seen":"2017-10-25T18:46:15Z","last_seen":"2025-10-07T16:13:12.377254Z","alert_count":0,"request_count":1,"received_data":215,"sent_data":516,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"americanxpresses.com","ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":408,"request_count":68,"received_data":8309326,"sent_data":35805,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"www.aexp-static.com","ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2010-10-07","domain_rank":82636,"first_seen":"2012-05-24T14:06:16Z","last_seen":"2026-07-17T00:27:20.990309Z","alert_count":0,"request_count":9,"received_data":458167,"sent_data":4997,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"assets.adobedtm.com","ip":{"addr":"96.6.17.25","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2013-11-22","domain_rank":3051,"first_seen":"2014-01-28T04:51:35Z","last_seen":"2026-07-13T10:01:42.486755Z","alert_count":0,"request_count":1,"received_data":107601,"sent_data":555,"comment":"","tags":null,"fingerprints":null},{"fqdn":"iwmap.americanexpress.com","ip":{"addr":"139.71.113.137","port":443,"asn":6307,"as":"AMERICAN-EXPRESS","country":"United States","country_code":"US"},"domain_registered":"1995-06-04","domain_rank":222056,"first_seen":"2017-07-06T09:25:23Z","last_seen":"2026-07-18T07:23:17.561094Z","alert_count":0,"request_count":2,"received_data":168,"sent_data":971,"comment":"","tags":null,"fingerprints":[{"name":"F5 BigIP","description":"F5's BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions.","website":"https://www.f5.com/products/big-ip-services","common_platform_enumeration":"cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:*","icon":"F5.png","categories":["Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-one-seo.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4fe732deecd7b4264e7e19ff8f9e01ad","sha1":"2fda2e2634e94a10a475a1c17edaf8623494a1f6","sha256":"7996affe33bccfb8f2706f8f81b0d93b41e550d2f83aa74db8bab9ed9df30859","sha512":"f82feb651854b413e8b0a608bbb8ac2f183ec10915a97690acf01e6ff1fa17834fbcfb658a2e8d758ad9c0ec38ecee8ca13f325fee7a601db5f0ad7fa36c7083","ssdeep":"384:85cXkwyPYt/pRxnSpWTiw5CG2wOyd4eyq+veTRCJj/5cMMtJbsyzTb:l9nAWwwOmmeQ2J3Tb","tlshash":"c0c2e58cb5a1f8a607a225e0042f614bf27e092ea4ada8d5f750ddd1acf4d5e4137f38","size":26360,"data":"","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.206913Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-page-wrapper.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"9308865c2e11206ec359ce89e22ace8c","sha1":"e2ab2af0e7ace463d85968b42e50deaf78a4bad9","sha256":"b6162756984a88b34a59a6fa4235486e5c594c09961c474335b8b31ddcd30531","sha512":"86a9495585dc715b0b643353ed99c57acd25cebf3f377aeb66066694762b458389466a569d902d3a7284d49f02cb27fbc6cdd98451fdd6569be23fda52418532","ssdeep":"192:Kvh3Kgh22U4vPnL4FE6+zeMdHN30ymRWqrrPJ2EBbCVo0XMJ5an:Kvha8VvPMFFLymRWqrzJ208","tlshash":"2b320ae977c0fc9a57f328adc42f0445e1659a7ee84d6881e25ec0e62479349423bf78","size":10968,"data":"","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.224293Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-identity-login-page.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"576f76165a1091e08549d18659c45ed0","sha1":"c7bb3c08bb7a8d6fc2158c35be2add5dd4cbe872","sha256":"a789228c2176f8fa139b78318865406aabc5b4d9757d7d2b88ed2dacabd8b424","sha512":"136fec081a0a0d582816c4c0ecbe727bb9808295ff21fe640c34cd8f1470f2c6a734a883d5e9799d41e497b6c669cbf7ea845bf1138b1da47118ce3bf457d223","ssdeep":"6144:VfH0hNcB9zfIA5yft17aoKgs98qtLrqor7NQ8K9ErEj1:2+5aMi+ro","tlshash":"78141ac936a0f86513a750a2903f110ff27a6a7d94ace490e361cce97df558e4227f39","size":202132,"data":"","first_seen":"2026-07-18T00:23:58.508947Z","last_seen":"2026-07-19T03:06:35.211399Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-login.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6aa387c832cfb99000b1d2b436c2960b","sha1":"2c5428b0dc2b1f6676f9c3d1703bcca5735e46d2","sha256":"3c9edb99b7cc997ccce0c718bfb2fc02994cb5b96efdd43de26168eb7e003964","sha512":"39122cfd38b0b48c3948814fc404e7e8d8dad995a514c08f73fcd80bfd22c1ed4237c2f521c21fedd514416dce55c5dc916246bd63ebd4be69af1a410cc510a1","ssdeep":"3072:G1J6/GRk7SMzzfXIA5yft72297aoKJas9YUIP1:+JJgSMzzfIA5yft17aoKgs9AP1","tlshash":"4ad33bd97a70f8a107a750b1603f2107f2ba192a54add890f621cdd6bcb984f8177f39","size":134316,"data":"","first_seen":"2026-07-18T00:23:58.497798Z","last_seen":"2026-07-19T03:06:35.260587Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/app.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c42ebab4362e6c83ecba44fe44bb58b","sha1":"e6c2190e6c28469bea57562051e05737b0d39613","sha256":"08b55c9f436769b1b028f485c57f59b645c046eefc9e96134cfa43750f3d2fd2","sha512":"15236b251950721fda5d54436a7b885e0fe6d4bd7eea3dd285c7557364571e1b2e5f0fdf08180b92f10515e35b22ecd38ef179f0240ff7d730ab80b645dd79f1","ssdeep":"3072:5yCOKGEDtFjEcgBo/g3GoskfGlCe/sffvel:9Acwo/gCkelB/+vel","tlshash":"bb148488fb99b17b13d22650005f500bfa3d9e99e8194589b396c4e7acf8d4cd0a6f3d","size":206715,"data":"","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.204032Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatSupplier.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"177db1fc83565ecc050d0ac833eb9169","sha1":"1457c719b7192bc2ecf1c5262d8eb5f64e729b3b","sha256":"6f6af66a24105bf89f2801f0c810ee19a6c059af9f36255c51db12f1c8e303c7","sha512":"fcd95b9d1bfe38f5b72b3f8f22c75e7e76eca0d4c2f8b7ab9362f2d1c074251f216fd9ea02b3f15adaab0ec4eb6b78ed56be9a6f76550aed49d0bb36776cbcdc","ssdeep":"","tlshash":"0e413671750690745652742eb07f7f06a51345ba5c404fb486ddc8b43c6c9cb09befc6","size":2045,"data":"","first_seen":"2026-07-18T00:23:58.468164Z","last_seen":"2026-07-19T03:06:35.214015Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/qualtricsIntercept.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"d9231fa034917dae2dc3fea2b619469f","sha1":"c04d852ca0c13c32d2ee29f102429d7e3cd094dc","sha256":"f6ba7b956784868505c5d2dbbaf7394bf429ea5f787b6f3871c46f64c5d20402","sha512":"8143f5d920a80bec3a3f61422142d50ff0d436bd77fd481d1c3d1888b08480b6a6652e0a5686ca303db6c2811a3d8fd262b02c3774e842d07ca692421ab3ed3a","ssdeep":"","tlshash":"295196f530a4bd300382b0d8423f5206f0771ea620d975c8e555e6a1bd2085fe1e3fb6","size":2693,"data":"","first_seen":"2026-07-18T00:23:58.49868Z","last_seen":"2026-07-19T03:06:35.252078Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/satelliteLib-d900a4871c4036e18e47cec789c6f0682dabdb44.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"d19c4c5cd290a3149a524c9b62ee9aa4","sha1":"c65f60fc58c2d00fb78fc5e4d874cfab353f7aa7","sha256":"6ffdb982ada5a7ed0527e5562bd25a313ee12c9923a7491159bfac0bd232364f","sha512":"aa21c0c75bfac21a6633aff75698e0cbef842f69cc160e275079fc0591aa62c191d30f2a7508898e319f4e6ff28f89d2cac99f1c8681af139d43530ed3c39d69","ssdeep":"3072:7QU97fid4TZ0MfTtQ1tffmiSMWNjbJjkIogo3RrDxg4AcBVxMBAi9SZdlfKM/dMs:8Iht0G8xmhNjtjkIogo3RrDxg4AcBVxj","tlshash":"e9f30a8e72f1705d52d62079403f610bb23beea624cdc070b6a1acf45db495e6266fbc","size":169627,"data":"","first_seen":"2026-07-18T00:23:58.472888Z","last_seen":"2026-07-19T03:06:35.247408Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"b047d275fa16655e6a02177568cb92b1","sha1":"2ed86ed81fb5af29bca88431b703bc90ff294272","sha256":"b0527cbec8248da53067ceaa7385cbd8159ad02008d478b666f940d738fbd56e","sha512":"0551195197d360c2666dbcdc7a3657068182d519968854481dd7b681158e687d0187df9d736de23bbd34d837129128239ad7c8091f101928c8be037e60426b09","ssdeep":"1536:Rc2ZftDcmj04jUrO3EveyMXki/+btOcoAj52T/yviM7ziy9jBHTEWKiwYim:Rc2lxcb4y72rN+bA782DiiM1EWKW","tlshash":"62a35c8a76e2146a01b720f9522f1007b13bdb971184c874bd9ce5d0afb4a6711fbfb9","size":107080,"data":"","first_seen":"2024-01-25T19:18:32Z","last_seen":"2026-07-19T03:06:35.211912Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-footer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"bdae22a3183b48e9068ed1eba2212ff1","sha1":"6e8dba63f66a1d5ba8926e97c67b9962ad128256","sha256":"aa46b2d01e0aca0990accdf7bed437a48abb72234e7dc1bd4a473dd39c249049","sha512":"0bd209fb360ba33005145002c427471e74c38eb3632259d8f1701e244db529d7029bc33625817e6d50288e8bdeae741f0f28ac5734a243b9aeddabc343aaa19a","ssdeep":"3072:2NY8iHGylWlyDD/DCD/DCDAc8NrJrriXkrlbuv5DDD2DDHot70WfJrHFP2h7G+Wf:oY8+GTyyY0Wf/DQbnw5MxM","tlshash":"ce548c282617b758e059d08bfa3739c4caa9d18a944614d29f3d4bb31fe37d2de68d03","size":282055,"data":"","first_seen":"2026-07-18T00:23:58.496908Z","last_seen":"2026-07-19T03:06:35.196933Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/Bootstrap.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"94cdd93eba6c5b4f2247d991d18fc304","sha1":"25f1fcc99b1a68cb99ca5c5242932a9c55373d81","sha256":"86729b57f478bcd631b9d993d9df798aa7cdd3ab5cc3ae265ea6318aa80f2bbc","sha512":"2fe67b6a583e20dc46a3dd65a1a22882adab4af1c2e4fafdf0c82c96c3be2ca231ac30635bc5fa84b9e525651f210af73e1b45e7b8c08286e409d78094072a42","ssdeep":"1536:iGU40YuIqGk+o1egm8sRIuiClrcsX5QrF0hVHtcCgVzU7P:JFkegm8KHGsHW8P","tlshash":"9863198833527562c6db30bc90ff420a71b39969b9895815e148e2d87d34e4fe27bf9c","size":69370,"data":"","first_seen":"2026-07-18T00:23:58.446735Z","last_seen":"2026-07-19T03:06:35.225245Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/CoreModule.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"e62351b87de1e81c67f88334a5888b53","sha1":"62a5f7ce04b54a4e93017ce4c47f1aefc5f3959c","sha256":"8b0ddf8a0f2b229a15eff81a8af8ff67d6593b86bb7405f598b6db8d61b6375a","sha512":"3d3b3e0e83d055a75295b265685054792554ab9125b478492f539af22b15985e00fd6f1647a85be98c52bc38e863db0543c1827fc5375375e11c8c4514f3f04a","ssdeep":"1536:5smxI9zSgwNqInTG+nNO/rx/MYpH+EOaxvKRvDo8jl:dNnyoYEEOaxvKVDo0","tlshash":"3ba3188db182b96947e731b0913f220af13b11a8258d40a8b529c5d1bd7698fd237ffd","size":105246,"data":"","first_seen":"2026-07-18T00:23:58.461723Z","last_seen":"2026-07-19T03:06:35.209446Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/851e5fe8de30f98cab761711f92a5f05.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6924a044d2e8d802a6db99d9cd9fe68d","sha1":"581122769c06df40c53e821f2c7841755b495a7b","sha256":"d9296a01b4d1232c0f781428e5671860ff375ff623b2b0dbcb72dc53ffe86311","sha512":"75499756170b06d4f3d8c01e1676d31bc9f4c6d8732f542fb6172eb9871a004b659d43568cba294ac2129308014702650b8ab22dade158aa59b618ec890d305a","ssdeep":"384:M1Nr7ke12ONLT2GTjIfN+ttI0MLFpAqcNhjTK:M1N39NLNABpsLG","tlshash":"45b2a7964b20719963f10a2e3b1f7705a2b304f60a81c178868d5a387f9968bd77f5cf","size":23447,"data":"","first_seen":"2026-07-18T00:23:58.51135Z","last_seen":"2026-07-19T03:06:35.199912Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/api/axpi/ensighten/liveengage-lp/bdaas/le-mtagconfig.js","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"375b2eabe48c53d2ddfb48ccedcdabd6","sha1":"324cda82e51a0eab0ac41d8361832c686358bbaf","sha256":"0119d3c9c9d6499e8535e8dfff1fb8d2f891fb1434280b3a185dc82f1a944e32","sha512":"003e9f9ad32bef0db9a882a2f9281d247b302aa0b9c8e87fbdf5c02fb7d84bf6050934f48b79a4b83bdd5f0020a1c52e737e136a8095f8340c4ae6efc77f12bf","ssdeep":"","tlshash":"0031ae2d7010b635445620694bbfb30bec77609a58014e643528d8fddb2ce8b19768ff","size":1756,"data":"","first_seen":"2026-07-18T00:23:58.506007Z","last_seen":"2026-07-19T03:06:35.231571Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":true,"md5":"efe0e1fb220f44dbca0b6e787fefabf2","sha1":"ee40bf81b846bc71f818b6ece86e71b300b16a79","sha256":"f375636ba452a9e4b30b9eb7bc95edab9274acdc9e247f540bd481037091be9c","sha512":"06a3f7f62adaa2241be65b3ef4a15e5a2ffd544df6771fad35f97beccbf33b0cef93a8ab35faca1a5ce16db6ea98ab78e2505529b45c70e1abdaf3ba3d30883a","ssdeep":"","tlshash":"9ad05edcaed6f5532aa3f46ecc17d205a13b4142504c5e00e7f983e25ed353c9363892","size":268,"data":"","first_seen":"2023-03-07T01:19:57Z","last_seen":"2026-07-19T03:06:35.261511Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/en-BB_i1_a1e63395.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b1953b99cf516c88dafda47110c6cf2","sha1":"db3aa23f228e8240f6859d0538be88b11cf902f8","sha256":"484d27df06c0a43ca47a5fb2d89458b08816a3b697e33452d633a73d8c85dc93","sha512":"7f46ad66fe7d1918f804706e70187c64d608e8a972b06ab492df6e028c7fa7155b77ae671f70f914111405e34c81cd1a1f3714aa22c55870fd5be5867778f0da","ssdeep":"192:85p/egEH7uEt6EtXElxiMs8sVAyfEt1i1:t7bfGDs88ABW","tlshash":"5882485bde430fff0d7d6fc506231346351a1aa9488e0b20b97af50a3b5ae6c16ec1b5","size":18835,"data":"","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.205211Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/1.1b6f10a72211dd7774da.chunk.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c6d45c623756e2474fa3c87df57f83e","sha1":"7cec6f5a7e3679bbcb97021d24772bcf89bcbcd2","sha256":"1030e9d4c753a212fbeb3009666cb3bffe6a2624441f9762156c4cad06dee4d7","sha512":"dff187518751563acd399312ad17dc57fe21ce980bcbcb3441be8dd042ece931276fb293b80a9588bc58426280cf7dc17727392cfd4ca6cddabdb0fccfe0aefc","ssdeep":"768:HJUBrTKABAYAcyGIA49DAy8DiAhAPEqsLV9Psasvg4GLa9utvTBapIBvT69aP88:paTKABAYAcyGIAgUiAhAPORZsvaa8tvz","tlshash":"3bc29697b686ba5400cb3062a47f57c765362039414192b6dc06c4e8a6ffcf4d26bfeb","size":26968,"data":"","first_seen":"2026-07-18T00:23:58.450696Z","last_seen":"2026-07-19T03:06:35.232098Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/runtime.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"a826f5aa3b4bb6ed8d2b395903b56e8d","sha1":"e05903f4e565034d21588697dcda954e99d6c943","sha256":"cade1e12dd7bc1876f6d3840bc47d28c6ea956cf597d201924a1e7524e5cc983","sha512":"e91b419fc29e8a387c0d8ba4066f58d31e508e29681570f88d0167b483e961cf0642100d00cd61f5a6f1edf71a4b5995f23c4137f9ca99c5b6b6c3090973236a","ssdeep":"192:r8fsvXrfhCpKwUczfmELq8DoCJZsbkHW6mzLl/2ZBmNh9/D8TVvxcchzLydil4kG:aHNnBhb8UbNYWP2pZ","tlshash":"ff62fd6cb8bad4da0354b5f0ac00b5e9b516712c7cc0e91bbf9c8d65a29cac8f1ed570","size":14787,"data":"","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.216663Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/global.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"b88d3252d3046c932db844e6e45ddb3c","sha1":"c5bd4037ba4a9130bb783b01131c5276cdf64f33","sha256":"2f491795582931c1d31512782dbb3d39a854b62700c6949a9de0b17e17cae64c","sha512":"4ac8de2656652015b87aa43ca5c4f84e78cc369445fa5fe64ebe2ae75c30aa6a3ce4c64912c7e8076131d0c934de25d4ee43429bdd00fba9d7376a0752b0a2be","ssdeep":"192:io3TvDv9vzvbWvr9iDo2nBco0r93MvHvQR+WrftgmvIIxgKjnRQWDzKfuRt37Pi:9JcKmho","tlshash":"8b3279090b3024cdc1ea137db99e878091a595fdeac2592e53ce1b1c5f2885b33fbd86","size":11374,"data":"","first_seen":"2026-07-18T00:23:58.505115Z","last_seen":"2026-07-19T03:06:35.226225Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-voice-of-customer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"f2072648394113eef50afaafea0621f3","sha1":"68889599b1c8be0bc44a22d0ecbccecbc66189b2","sha256":"85bbd9fec0b60035ccefc6088a04660609ee27f12af3efcb2f2d650354b4b6d6","sha512":"5b97fea7048e6390f3178feef3e0f8ae53b6f4c20f16da5afc49d8a9f8dc055bfb8ef8ca0a94b156988c434842ea1072aba38529f1519668cb8046abe0b71495","ssdeep":"3072:8wEkmZlm1zfXIA5Wft7229jaoK2asgOxH7b:BEkulm1zfIA5Wft1jaoKzsgS7b","tlshash":"74a31bc57ba0f8a217a790b1a03f100bf2f7982ea49de491f255c5d4adba40e415bf7c","size":100572,"data":"","first_seen":"2023-03-07T12:58:08Z","last_seen":"2026-07-19T03:06:35.22298Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/rum-reporter.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"c13608e2a2d66de6d3354bf3ef7737ae","sha1":"054b7f2a736ee365ee5b4c071877dd4f4ac67b4a","sha256":"0fe9b1bce062d63a683bfcab9ac77eeb1f8b1ace7b0e138365a83f2a5383ccbc","sha512":"d6f9269a53168e59aad3c71b8758365a38c28f8f218356574a1508d9162bcadf842fc08ac355a769493541101fbe80ffc71ed6888821b61c4ba653b1a21f3444","ssdeep":"1536:8lAnkufieqam9UrCXBtY53xSLwFaZL7V4jwI95gq:aAnjqDUrCg53xSLwF6L7V4L7T","tlshash":"8b73f8c9f561b0e103e7a1e1803f510ba336e529704a94e4f765d9e6ae7c98d2237f38","size":77050,"data":"","first_seen":"2026-07-18T00:23:58.500695Z","last_seen":"2026-07-19T03:06:35.258494Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-19T03:18:26.068225Z","times_seen":726528,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/tag.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2ee8a9cd68c3d310a4c62fdb4b5c93a","sha1":"67eb5f9547f1d9de0a8b143c3b50511c26281399","sha256":"145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7","sha512":"4cfee56ca068134354be94127465e9aa7bfd8f68e0d2b6d6a367c0e9eaca5cdf5fc39290f6c1cb3dd4dc9319b60a38f810f220ad836c94fedc991ae17eb82159","ssdeep":"192:speXIcO8AiGMXMGc1IajSFkhChE7KYHliXMvjmPc3l7jcCVVmF6Q+3vMjT8LEc6q:sp63F4M3jFkfHlHL91cCVVbO8IkFAjl8","tlshash":"8da2e885f38632326ab9213ba0af170b6075d9a67c4c86f1d194ece07d7547c02a7fad","size":21652,"data":"","first_seen":"2023-03-07T01:02:45Z","last_seen":"2026-07-19T03:06:35.259385Z","times_seen":177,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-data-layer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6db63f423a72c7813cf37fe1f389b6a5","sha1":"1ff1159e3dbefad50cf8b8ac8c723ddf4d89b85c","sha256":"c86722669e1d385751732d9ac838a064ccfc095a9eaae53203d087d5a3376ecb","sha512":"79face2f55d89f7359282dafc086dad3a0d42c962c489da97ff258870f3cfb36a506d5d6844315c4e063cc6f06377756ea56568f50fc8f101cbaa49221035139","ssdeep":"6144:M1T/H3gbSBEO9bG/DcuHX5H7iqgMUEGwBAG:2TXY7Hwwh","tlshash":"8524d78d7a91f062439361a5403f640ff2796929a89ce490f361d8f57cf949e8327f3a","size":225345,"data":"","first_seen":"2026-07-18T00:23:58.479101Z","last_seen":"2026-07-19T03:06:35.233098Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-root.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"e249b7e7f70eee79a53cee1712423338","sha1":"7106df43953ac633314af6124b202ba2740699d1","sha256":"8128a0300cc297d2ed98634f5067bad88cefd72a299f23e5f69653d7c2db51ca","sha512":"aea1c74612f0f420e6ae111af9d5656fa2de2f12b93a8db62ce2e2e6f02ae197d1ce11f1d5313292d04b180484823344c710c8322bdf53d1ad737c3981a2ab46","ssdeep":"768:Yhw9A+ymNOfezRPhCtY5Q5wUUnQ67gdyTK/Vf:HpLNOfihCtyKw5XgkKJ","tlshash":"2203d7dd7581fc92d3e321674e2f240ab0aa4d1ca44be8c7e35ae5d99c3564e0297f38","size":40380,"data":"","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.229858Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatLauncher.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"37ee88b1fcd9a7701535dcfa6d997f5d","sha1":"2a69c449f361b14cdd67791092320d26662780fc","sha256":"84d59d0055b664e8154eb251d1848b4d036c8af53ffc70127f8a9757ffcfdada","sha512":"1d77de32d8c8bd747e9c8fbf55e76d14adf988ec4c165921d88e85573b19a34c7588c05ae82cc26d1b4301cd90dbf9d00eff44c312cbdb7d394f595a968652f8","ssdeep":"384:GXzoUqDYHN7JwvmRzWhLWkWeAhcMvupANbisqi2zfEyoikopfrPrxklWT6s:GjvqDYHNtSmRzWhLWkWeAuMSAN+I2fF/","tlshash":"88a275e5fb8d503b64a63066282f5189757c84732d04dc66fc0c58783ba4e6e913fe9a","size":22171,"data":"","first_seen":"2026-07-18T00:23:58.45434Z","last_seen":"2026-07-19T03:06:35.227322Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/tealeaf.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"b53944527041b52c88a5a5ffb88c1ba9","sha1":"20de879d0a3804ad8aa5a16f854bb553ba6d1d65","sha256":"d2e62e9e3fe81151b8b0fab489e81db18be5471adfd2220b31f9fbe1873c6a4e","sha512":"b923e7835737ba4d985cec52803b0015ff900bee7fedf77d7b5cff86598ba18e938c6d6ee01a40fb7cf018a34ec270a23beada8212d1eeaf76f40625bb632ce6","ssdeep":"1536:eoMQ12cwAa/V9gceW/Ymlxt/tBJPGY+hmwKQE+Ln8u6L5exJFGpIdNYhoPA:MILegHgtfUGpsNYWI","tlshash":"63932a5933d234b64aeb2030816f2607b53856e3594d6060eab8d4e17cf8c8f957bfad","size":90568,"data":"","first_seen":"2024-01-25T19:18:32Z","last_seen":"2026-07-19T03:06:35.254986Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/OrchestratorMain.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"82978809b9584ea8399f65bc70c9b37f","sha1":"985d649332c89e4084206ea1a4866bb92502161b","sha256":"88d557e7d7cc318dd380e79d6ffd921797b7266d8971aa8f55802f6a48db1184","sha512":"a400af26da49acaa0741a71aede33cc01ba793cbdcb098cbf98607d4de60da0350645ee67456726a85e93be8cbfa67416b57075b18f2efbdb91dbb0a93d5d92e","ssdeep":"1536:D6eDWucxfotNANA5ACJz81jfd1qnKPCm6:D6YWVld1qnKPx6","tlshash":"023308ce714c783d8ad62970e47f22067633213d648f84a4b54ad0ec6dbb99e4227bf5","size":53299,"data":"","first_seen":"2026-07-18T00:23:58.491869Z","last_seen":"2026-07-19T03:06:35.207439Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js","fqdn":"assets.adobedtm.com","domain":"adobedtm.com","tld":"com"},"ip":{"addr":"96.6.17.25","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"b047d275fa16655e6a02177568cb92b1","sha1":"2ed86ed81fb5af29bca88431b703bc90ff294272","sha256":"b0527cbec8248da53067ceaa7385cbd8159ad02008d478b666f940d738fbd56e","sha512":"0551195197d360c2666dbcdc7a3657068182d519968854481dd7b681158e687d0187df9d736de23bbd34d837129128239ad7c8091f101928c8be037e60426b09","ssdeep":"1536:Rc2ZftDcmj04jUrO3EveyMXki/+btOcoAj52T/yviM7ziy9jBHTEWKiwYim:Rc2lxcb4y72rN+bA782DiiM1EWKW","tlshash":"62a35c8a76e2146a01b720f9522f1007b13bdb971184c874bd9ce5d0afb4a6711fbfb9","size":107080,"data":"","first_seen":"2024-01-25T19:18:32Z","last_seen":"2026-07-19T03:06:35.211912Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/12.2aec0afa485313e036aa.chunk.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"53e330a1e2849caea241ece506e1d392","sha1":"973b41d842452a6ebed8ff6e2b5e617c3c1e44f0","sha256":"0b31cf3c7b35b652b10f6dbb26e87767ea43735e862c1fe7e5c5e21e7a4728ad","sha512":"a0eff7dbb008ce571c5a5a797018ae4310162b4a9e90e83c4b2a96d72d6c88d691afa14a0c86e67ac60a1f81636d74edfd99c18c99bb54c0fd45ba7fa1e3efc5","ssdeep":"","tlshash":"2b51646df0e2746006ba74e4126f7783f22f9039210804c43b5ca2a07b749c3d235bf9","size":2646,"data":"","first_seen":"2026-07-18T00:23:58.495063Z","last_seen":"2026-07-19T03:06:35.228103Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-login-alert.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"f67f8b0f30a10f47ec219265b3f87a95","sha1":"f4db2de9d5d2b4daf4e135a5199f58a6b22bc937","sha256":"cb299551b79248f1ebf017b22aa9023ba69df834545562a624b0d5f1f089da3e","sha512":"04874ec30940e1337cfd5bb6ec484b163df41cf19f9490b425e3bd68091b1572b218924af2acf2fa2065bd0627a3127c2889e9af4ad2ce811cfc811cb2cf8555","ssdeep":"","tlshash":"d55100c93680fc8633f620d4400f2525f06bc8236569b882eb658dd8bce505ec379abb","size":2669,"data":"","first_seen":"2023-03-10T09:25:21Z","last_seen":"2026-07-19T03:06:35.234062Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/FeedbackButtonModule.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4e84751e1a2791057ad76e33a348b1fc","sha1":"e2b0465a343c96ea938a5b11c71e0fc94341ba45","sha256":"bc183e971ed29f01daf0f8adec30220f454776989989102a0d3c6f5a3a23fa58","sha512":"88d97801ff530d08b0f91f62d5bb597d9047d97fc2ab593393187b4e19a4341a6c6aef7d4695071011e4dc9b0a528947b22ff9f7ee21c2e7e4ea6ad0dd1e7471","ssdeep":"384:zjZ0B3NkYEGYlEeuEyvGAB+13Aw9y8EdGj6Fin5QyQkvXWINshq4PQfJ0DQ3OV8c:/iBev61+7+SnVYidsgR8sbBz/AQUYid","tlshash":"e243f6cdb691b4a543e7b1f1903f860ef17ba854745a99c0d229e4e4acb988e4037f3c","size":57029,"data":"","first_seen":"2026-07-18T00:23:58.45176Z","last_seen":"2026-07-19T03:06:35.215095Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/vendors.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"9a5724be0330ea865ae3b361ff03d454","sha1":"eb8c27b5ff2550874850292368bafb70129dab9a","sha256":"b4d5a66919bb1b538fc20c24a261f8cc4dc1f3ae4fb73d963661690cb1ffb17d","sha512":"31d0309b0b6b46b50ba54eb70ea472624cbac436a3ab6829fa046bc887330af9c612633db7de16e75ebde364d1342bb87d2a8efb146c24d61cf54a778bcee7e0","ssdeep":"24576:fuvxR1i0qoqVOp4whaBsLmVP7r4a6hsiM:fuvxR1i0qap4whagmVP7r4a6hsiM","tlshash":"a905f6887691f4a242e351b6442f140af27a5c2cd89db494f365c8f4befa44d922bf3d","size":808317,"data":"","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.25025Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-identity-root.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"1195af2ab7f4fdfe3770dc2d4c3dedf9","sha1":"c36530f879429f11a981106bed1ef967812f3370","sha256":"3a97874901b84e6978f3391f2a1143ac401a6bd2a421a82585f5b12ad739d5c8","sha512":"4228ebb9143a50e2d0f5eecf53c311f213262bda15b4a50452591976b3f4ff0ef0e85178921a7ba1a492c8408127c5d1a25d326b8f28185f8096510a6d68e503","ssdeep":"3072:e5p9HK2ITHj0IAWtWarD+Ob2iU4rS4mlopzzFPmQa:eT9HKLZAWtWixLrjm0/FPmQa","tlshash":"c61408ce79d1f06253a361a5403f500bf27a5a28688c9894f355d8e5bcb899e8337f3d","size":195058,"data":"","first_seen":"2023-03-10T09:25:21Z","last_seen":"2026-07-19T03:06:35.202345Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-providers.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"c0bcacf2292722fcca0b9340105850ba","sha1":"8c58bbf749afd4b9d283c602f78ceba5b351d969","sha256":"3f52a057f2dd50938794c83929613b0b42f643af457a45f13cd8247ac6d56f9d","sha512":"657a67ac7bcd6c61b527ec3dd32e7fe08c9cdc51d2a32739fe3e023748d4f73ce0a6299ab774dc411b2d2e9b8c84f4ebce2228eb9162136562e4731496c7f197","ssdeep":"768:XjQ/jQ4DQxDigWWrZFWlriTE8MWikrHoNyq:XajQ4D3gWWyNWNEAq","tlshash":"8ff2e68d30a6b8a6479350a4003f200bf37b5d79689dac94fa64d9e67c74d5e8237f38","size":35519,"data":"","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.235083Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/le-mtagconfig.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"375b2eabe48c53d2ddfb48ccedcdabd6","sha1":"324cda82e51a0eab0ac41d8361832c686358bbaf","sha256":"0119d3c9c9d6499e8535e8dfff1fb8d2f891fb1434280b3a185dc82f1a944e32","sha512":"003e9f9ad32bef0db9a882a2f9281d247b302aa0b9c8e87fbdf5c02fb7d84bf6050934f48b79a4b83bdd5f0020a1c52e737e136a8095f8340c4ae6efc77f12bf","ssdeep":"","tlshash":"0031ae2d7010b635445620694bbfb30bec77609a58014e643528d8fddb2ce8b19768ff","size":1756,"data":"","first_seen":"2026-07-18T00:23:58.506007Z","last_seen":"2026-07-19T03:06:35.231571Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatButtonBootStrap.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6013fd8031f1f76b77ec69e509ae524c","sha1":"bd7d6addcfc9691102b6f95d76c3a4526391e226","sha256":"5a15eec2b955aef661c0bd2d0665b368a9619cfd34e662b2d980e623f8b68fb6","sha512":"b4c23ca77182362233e861d0aeacad67a494693901f6b47ce3bbe3bbb2c2626ee37737cc015a1b7913ea22f023497403b0f2c01ca3e8dc74791040b8881601a7","ssdeep":"3072:UNmKGxcGGQGuzVEsJApBCBS7sXVdkRLZ4YHSKcTeRelAoJBuqjvlbdDa7it:LKCcszVEsJApBCBS7sXVdkRl4aRelPNt","tlshash":"b2e3d8b67208113e45bb232b56372304fc3bc1375a826570789ca8786f78d97927afd9","size":151480,"data":"","first_seen":"2026-07-18T00:23:58.481438Z","last_seen":"2026-07-19T03:06:35.210867Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/cc.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e7df8358ea00a363619e17142b88e5e","sha1":"c186c442edfcd79bdde139ba73679aac939c2ac6","sha256":"f88f676bbc1b598f65308c853774dbd758a5da5cbe2c4e7aef5327e79fea64aa","sha512":"c941bd6e7fe37ce8a7a43ed2d4469ab14253aab55cf90d442bd96315474f449b11a3578a0313bcfac3fa34a448d8e56e22dcf28596604ae6f08398c5dca30b8d","ssdeep":"768:45GfLqBHF+Ml48iYYY5SbKgvB/+l9yX9OnZA7:BfL2QtYYYyK60y8g","tlshash":"05f25c89323231295237327a667f730ab0764651dc02dc80a4f9cde4bd68e9b1277fe9","size":37543,"data":"","first_seen":"2026-07-18T00:23:58.487328Z","last_seen":"2026-07-19T03:06:35.208014Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/app_vendors.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"bfcf94af3b9f6d451b6b0e93b7a42bba","sha1":"3da0c5529395e93d28394cbc0de5e7e5ccab2d43","sha256":"b879b6e86af81143065ea342561907c61a102a14a7e0890d3c8723b3500c6b53","sha512":"c44f21b4031d9270b6fd28242cc3e4b2fef67b0e5ce982a95402234808b124bf465ddb0b4a2075e363b5e49a60f6b1c2b7392965655a40352a3cb50872480ecf","ssdeep":"24576:w0lOuhNwEgkLkVmPNJr7dwWQoC1qTn072fTaI0jSiq3akmWnMqAW0gNfBmvKl8ZV:w0lOcNwEgkLkVmPNJr7dwWQoC1qTn07N","tlshash":"6725d6c97291f8670fd310b0803fa50bf27a587b244e9960e611dde9bcba15dd227f29","size":1026267,"data":"","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.254121Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/en-US.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"8428a16a6e010d36b8795a210c653574","sha1":"8ec396a82202672df94d87f1acb03a14328bdd6c","sha256":"509c9d619a243a90fb9dba381571ba57af8fdbeee50d9c73ee928df8c4b1fb1c","sha512":"c78ca1b3d117877810b528c988dfaabaf79730e4cd1bddaac8ede14c5439fb5cd23ffadd59e6f7512b4f6cce2330332c8dbb9cc31d00dab4c8fab78721c1a303","ssdeep":"768:cHonDDLD67hD7hY/BkwOY4jE4jbD2UV1ZK2UV1Zv2UV1ZPY7P4:cInDDLDqpY/BkwOY4jE4jbD5ZK5Zv5Zp","tlshash":"24c2769904e7787103bf11efdcc96a9ded4d67b4e113de2362222934c94be4eba0e509","size":26026,"data":"","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.229038Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-marketing-offer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"de12733ec20534bf1509927916b22d4b","sha1":"be50049a109fb6399ba1f99c229332f1f072b1c4","sha256":"a5c2e0644898a294333940f69057849e1843578059b94275824955b12d9f6941","sha512":"7d10f345fda6ec9e3a01a68130a0a72061d69108a2c8aa31b684db2ceb6698cd162aba4e6576be16c368e40cd5e8ab8573af7857ecb81205e525e23c10604919","ssdeep":"1536:t6PbdWMntU5t/kYcoubihsz9nWxnoY2hZo:QUjGz9n0fUZo","tlshash":"c4a3c6cc34e3f056a3e7257a003f140bf2396da9689d8404e655e8d8bcb961da37fe19","size":101450,"data":"","first_seen":"2026-07-18T00:23:58.483788Z","last_seen":"2026-07-19T03:06:35.248905Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/gtkp_aa.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"84cbd37a5ec4f68cd169659b97b945f6","sha1":"96096984f131fa2b9a7766f2023f74849f3adbda","sha256":"fbbaa7c67eefc2511be2ebd4fff4ecad779031c67acf108499ede1f1c2f3e5b5","sha512":"1948fdf107d69dac22ef3aba3873f77429b5e9c0249959d142cf7c5a1364e55e8150ae74e23b1040fb76bda8b5d2bf17bf802a6a838903d7112425bb04316237","ssdeep":"768:8GqGMzC6XfoMCmZYNLGFhaEzQBhgvBJgdZxJgrqvlqe1xXN:8GDMzCOZCmZYNLGtyZxJgrqvzxXN","tlshash":"8bb2f79a71613012828b21b514bf120e713b5aa50d8ea4f8f187c9e67df4e59522ffbc","size":25232,"data":"","first_seen":"2023-03-07T12:58:08Z","last_seen":"2026-07-19T03:06:35.197596Z","times_seen":60,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dest5.html","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":true,"md5":"70f483ff6def775ca99d53db0803f4ea","sha1":"1df686e39e3a9d78b1c07f212c51e3f89cc1bab8","sha256":"f35201095f199330e0153c94db06bdc8e0f0d34c8a9a13c4ea06b905954925ce","sha512":"a3fd0e08ca13958826406312d0eaf5116be73abe6e14b6c61ca8670d4f63af3265c5c68cff3745d476e43947625318ec96ecb55d039eb60596ee6e67d7a3f67f","ssdeep":"96:Nw1EOb9muLpw47eIDCpXHG5z/QkqJeMnSSyi8c2Kgn/UnNsnA2aI4j4C:xc/xDCpX8/in/y+2KgMSA26V","tlshash":"cfd1a78e365bbc5a916a20a0317e310ab0fb8964a84c6556b04ccff19f38d4f1876f6d","size":6682,"data":"","first_seen":"2026-06-09T14:15:32.870629Z","last_seen":"2026-07-19T03:06:35.262452Z","times_seen":172,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/api/axpi/ensighten/oneapp-webanalytics/global.js?vr=1.0","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7a3129f6cc7d7cd377430bde98ef421","sha1":"1c76f48d80e2d212a2846ab2a5b643d37f4d48b1","sha256":"bbd301222c05fb19f6bd610a880353298d29f0b517a21d8dc2a9ccccb1eaa75d","sha512":"0fa75f6aa93caf30a912c61bcc10f8316cd9dc5e8d52444fb114e5f0fdda372936fa187093a349b2e0edd767221ccfcb6d8f91a3815e6b48d015b850c7b73a84","ssdeep":"192:IP9SI9sS63TvDv9vzvbWvr9iDv13o382nBco0r93MvHv0v3vevDE6z8mkCR53Kg5:IPbGmlXRXONgf0Z9g","tlshash":"6a8299090b3024dd80e9137db99e974091a695fdeac2582e53ce1b6c9f2485b33ffd85","size":17778,"data":"","first_seen":"2023-11-15T23:52:43Z","last_seen":"2026-07-19T03:06:35.25753Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lptag.liveperson.net/tag/tag.js?site=14106077","fqdn":"lptag.liveperson.net","domain":"liveperson.net","tld":"net"},"ip":{"addr":"178.249.97.23","port":443,"asn":11054,"as":"LIVEPERSON","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"eeccf27f80d19705c17b9a208a7c3815","sha1":"6ab1382fb3489e818bed878cb9a5c732483d4b9b","sha256":"1bac70cdab1f1607fb6247f8e5e133050798c52b68a84409c1813b2bcf8f1ac6","sha512":"83e61ce8838ccc2f783f68f5527acd42b309acf827819f648fc16bcc151546d8ded7c66f40f40e865e3c622477045e6e80f7398978c3e8cb2171784f2abe9509","ssdeep":"384:sMi7TkHlEBG1cCVVbO8IkFnxWjXUwzW6NJ744G1E2lgeDT:sMoGOCb68IkFnxWUwzuN","tlshash":"edd21889f78272316ab6107be1af160b61359caa6c4cc9f0e1d0e8e0797407c43a7f6d","size":28888,"data":"","first_seen":"2026-03-13T17:50:45.512898Z","last_seen":"2026-07-19T03:29:25.948194Z","times_seen":304,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-global-header.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4087211800518ca80e0d04f2b7e7c7e0","sha1":"d6439c4325079d1cb0a1c96477738c2bf3b1d5fe","sha256":"208fd29ec9e8cc88a562a20635b2ce389b292739c15f87bdc20b18f187ece56c","sha512":"7509e9510359538cf813168bfd6e2c72fc1c6f6322b2882493179accfc23d4f797d0cf829d54763a3e3b8f3ccffdabb189d7e4056a65f64d89a204fb1cd369f3","ssdeep":"1536:FVeFIH/TPYeTdbeAf3o+pZ03bADQeiBiUWzPtT6ZWqDdpmyOHxhEIxpH:TOU/7isUcqI3EQH","tlshash":"3ff354c867f5724e027a359fe51b280ef79901be401d6ca3f20ee4de2cd5a9a83f1604","size":171891,"data":"","first_seen":"2026-07-18T00:23:58.467143Z","last_seen":"2026-07-19T03:06:35.2512Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-search-box.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4dd1d4eadef3af3cc2e08b0dff12b0e3","sha1":"0e32973dd58fbf96f2f93d5e3f5e8671c34a4149","sha256":"3d030cb67cffc32a02534cf1117fc9b1091fd1285255b1f4f3de1c5aab42df8f","sha512":"c6e037f5558e6bc941967ebb832ecee6f7b37c2c421352e261f3e4d3f4aced84b96bc317d7731c907bf9cd56a0a784412ee828ec435a16e69a14c153e9e1e636","ssdeep":"1536:dLlm1EAo2nSW7Q55RU/81mga+mJ5n9WYOaehIRRuhm637/gZdYbDqw2iyuJq9PAM:dLEoVl5U/81mgI7n0YOkigsvP2iYYM","tlshash":"bae3f7dd7590b46207e322a6402f260bf33919b8584d5441f769d8f92cfac9e8267f3e","size":145082,"data":"","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.202957Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/serverComponent.php","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"3d9216b661b13a03b641368674039ca2","sha1":"1e11bbe1e0f8a5e3c79061773159beb5bc0fdde3","sha256":"eb58627c753972d9868bc1b908e51c278bdd05a5a2db988d53134ca96aba34b3","sha512":"98d63e6d1b019f18282a92a4c41aff9095edeec8587e436e2852ee9a79db495822a856693d88a1256e5b62da225be92f618c7f473ef9739c3c9f8a204426207e","ssdeep":"","tlshash":"c7d02b0207783ea1814ad17c78cea39a8260043ddcd0134cc3cfa2080f588c37aab635","size":274,"data":"","first_seen":"2026-07-18T00:23:58.499694Z","last_seen":"2026-07-19T03:06:35.217246Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-error-message.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"38628cfd41064efd337a1b9938021b53","sha1":"841b4189c5e5aff7463cd6ddd4dd90d5890a7d87","sha256":"71f9cc0171c24caa1c85eb3acf8c41a3e4b4f2303a37d83850df47b9c86bdf64","sha512":"6d1f7355aac6cf968965de95ed2352fc74d594162d2613871dcd7f07f75aebed79f55bf5b3c3612341dd55ec23917821e4e8c0d32079c2b41bd439cbc5834e27","ssdeep":"384:jGTTgDmmNUnzFqcFAZZAcCWUu23ZzHnA6S:yTTg3z23ZzHnA1","tlshash":"1de221ea72bada0f83d3293f78573d44fd660b0809a3a457f30d4c884bd28660f5ab55","size":34020,"data":"","first_seen":"2023-03-07T12:58:08Z","last_seen":"2026-07-19T03:06:35.206509Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Error, missing Report Suite ID in AppMeasurement initialization","filename":"https://americanxpresses.com/web/signin_files/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js.download","line_number":820,"column_number":416},{"level":"log","text":"Error, missing Report Suite ID in AppMeasurement initialization","filename":"https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js","line_number":820,"column_number":416}]},"http":[{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-login.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.574Z","timestamp":1784394601574,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-login.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-20cac\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":134316,"size_decoded":40450,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (34158)","md5":"6aa387c832cfb99000b1d2b436c2960b","sha1":"2c5428b0dc2b1f6676f9c3d1703bcca5735e46d2","sha256":"3c9edb99b7cc997ccce0c718bfb2fc02994cb5b96efdd43de26168eb7e003964","sha512":"39122cfd38b0b48c3948814fc404e7e8d8dad995a514c08f73fcd80bfd22c1ed4237c2f521c21fedd514416dce55c5dc916246bd63ebd4be69af1a410cc510a1","ssdeep":"3072:G1J6/GRk7SMzzfXIA5yft72297aoKJas9YUIP1:+JJgSMzzfIA5yft17aoKgs9AP1","tlshash":"4ad33bd97a70f8a107a750b1603f2107f2ba192a54add890f621cdd6bcb984f8177f39","first_seen":"2026-07-18T00:23:58.497798Z","last_seen":"2026-07-19T03:06:35.260587Z","times_seen":8,"resource_available":true,"data":null}},"time_used":659,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":659,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/FeedbackButtonModule.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.596Z","timestamp":1784394601596,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/FeedbackButtonModule.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-dec5\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":57029,"size_decoded":20059,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55447)","md5":"4e84751e1a2791057ad76e33a348b1fc","sha1":"e2b0465a343c96ea938a5b11c71e0fc94341ba45","sha256":"bc183e971ed29f01daf0f8adec30220f454776989989102a0d3c6f5a3a23fa58","sha512":"88d97801ff530d08b0f91f62d5bb597d9047d97fc2ab593393187b4e19a4341a6c6aef7d4695071011e4dc9b0a528947b22ff9f7ee21c2e7e4ea6ad0dd1e7471","ssdeep":"384:zjZ0B3NkYEGYlEeuEyvGAB+13Aw9y8EdGj6Fin5QyQkvXWINshq4PQfJ0DQ3OV8c:/iBev61+7+SnVYidsgR8sbBz/AQUYid","tlshash":"e243f6cdb691b4a543e7b1f1903f860ef17ba854745a99c0d229e4e4acb988e4037f3c","first_seen":"2026-07-18T00:23:58.45176Z","last_seen":"2026-07-19T03:06:35.215095Z","times_seen":8,"resource_available":true,"data":null}},"time_used":591,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":591,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dls-logo-bluebox-solid.svg","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.600Z","timestamp":1784394601600,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/dls-logo-bluebox-solid.svg HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 2402\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: \"6918b382-962\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2402,"size_decoded":2654,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d97d46fe48d19d2c4f236b9a2cfee5f3","sha1":"a164f3588bb4b601c472461a24a6eec265bcf8c8","sha256":"028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab","sha512":"4bff0149d22172b1513b70bd2ba9f6be69807e5e33be803d100518cfe1070534160bf79992cdfc47277b3ebb98626e0e6302d08c1db8a0f7c41fd4de15b1fb80","ssdeep":"","tlshash":"b841f02a5394c3ac9819caeadfde49f5d61c52c2c09b835183b2952407f3ccde58d0e3","first_seen":"2023-05-11T18:50:33Z","last_seen":"2026-07-19T03:06:35.248353Z","times_seen":2184,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.689Z","timestamp":1784394602689,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1 HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 34756\r\nlast-modified: Sat, 26 Oct 1985 08:15:00 GMT\r\netag: \"1dc09d84-87c4\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccept-ranges: bytes\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285088,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":34756,"size_decoded":35211,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 34756, version 1.0","md5":"00e1ece1ed6008465632d7b9800e3f4c","sha1":"75e8f21ce1cf3fe13515c602bdcd8679581b6229","sha256":"3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08","sha512":"9d99b4fbdbd0e458748d103bd4d2f5588ee86f38eb3e1991cc26d0ed394666ea22452fa6a40a72d94ca1edbdac01a30f6d7a3f1ae0ae12221d1f77dac1a3e52e","ssdeep":"768:fGVjF1OT+EJfLBdHUp8iBrPaCoeCUiDOsHMC:fGlUzHUnBhozU3ssC","tlshash":"a4f2f112cea5d3e1c58db261ba699faa07ec10707dd5e8dc618ceb1d21933e15ad006a","first_seen":"2023-05-17T06:03:58Z","last_seen":"2026-07-19T03:06:35.212698Z","times_seen":68,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":16,"receive":2,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../fonts/Roboto-Medium.ttf","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.694Z","timestamp":1784394602694,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":274108,"size_decoded":44811,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatButtonBootStrap.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.545Z","timestamp":1784394601545,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/chatButtonBootStrap.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-24fb8\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":151480,"size_decoded":30224,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (926), with CRLF line terminators","md5":"6013fd8031f1f76b77ec69e509ae524c","sha1":"bd7d6addcfc9691102b6f95d76c3a4526391e226","sha256":"5a15eec2b955aef661c0bd2d0665b368a9619cfd34e662b2d980e623f8b68fb6","sha512":"b4c23ca77182362233e861d0aeacad67a494693901f6b47ce3bbe3bbb2c2626ee37737cc015a1b7913ea22f023497403b0f2c01ca3e8dc74791040b8881601a7","ssdeep":"3072:UNmKGxcGGQGuzVEsJApBCBS7sXVdkRLZ4YHSKcTeRelAoJBuqjvlbdDa7it:LKCcszVEsJApBCBS7sXVdkRl4aRelPNt","tlshash":"b2e3d8b67208113e45bb232b56372304fc3bc1375a826570789ca8786f78d97927afd9","first_seen":"2026-07-18T00:23:58.481438Z","last_seen":"2026-07-19T03:06:35.210867Z","times_seen":8,"resource_available":true,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-identity-root.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.562Z","timestamp":1784394601562,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-identity-root.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-2f9f2\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":195058,"size_decoded":51094,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (58714)","md5":"1195af2ab7f4fdfe3770dc2d4c3dedf9","sha1":"c36530f879429f11a981106bed1ef967812f3370","sha256":"3a97874901b84e6978f3391f2a1143ac401a6bd2a421a82585f5b12ad739d5c8","sha512":"4228ebb9143a50e2d0f5eecf53c311f213262bda15b4a50452591976b3f4ff0ef0e85178921a7ba1a492c8408127c5d1a25d326b8f28185f8096510a6d68e503","ssdeep":"3072:e5p9HK2ITHj0IAWtWarD+Ob2iU4rS4mlopzzFPmQa:eT9HKLZAWtWixLrjm0/FPmQa","tlshash":"c61408ce79d1f06253a361a5403f500bf27a5a28688c9894f355d8e5bcb899e8337f3d","first_seen":"2023-03-10T09:25:21Z","last_seen":"2026-07-19T03:06:35.202345Z","times_seen":13,"resource_available":true,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-providers.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.572Z","timestamp":1784394601572,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-providers.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-8abf\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":35519,"size_decoded":11657,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (15467)","md5":"c0bcacf2292722fcca0b9340105850ba","sha1":"8c58bbf749afd4b9d283c602f78ceba5b351d969","sha256":"3f52a057f2dd50938794c83929613b0b42f643af457a45f13cd8247ac6d56f9d","sha512":"657a67ac7bcd6c61b527ec3dd32e7fe08c9cdc51d2a32739fe3e023748d4f73ce0a6299ab774dc411b2d2e9b8c84f4ebce2228eb9162136562e4731496c7f197","ssdeep":"768:XjQ/jQ4DQxDigWWrZFWlriTE8MWikrHoNyq:XajQ4D3gWWyNWNEAq","tlshash":"8ff2e68d30a6b8a6479350a4003f200bf37b5d79689dac94fa64d9e67c74d5e8237f38","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.235083Z","times_seen":23,"resource_available":true,"data":null}},"time_used":543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/iconfont/dls-icons.woff","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.862Z","timestamp":1784394602862,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/iconfont/dls-icons.woff HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/signin_files/dls.min.css\r\nCookie: AMCV_5C36123F5245AF470A490D45%40AdobeOrg=1585540135%7CMCMID%7C33481947444931093357692668994922421927%7CvVersion%7C4.4.0\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 16 Jul 2026 22:25:56 GMT\r\netag: \"328-656c1ec8269d7\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":1036,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-19T03:06:35.200557Z","times_seen":38342,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/rum-reporter.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.541Z","timestamp":1784394601541,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/rum-reporter.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-12cfa\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":77050,"size_decoded":22824,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c13608e2a2d66de6d3354bf3ef7737ae","sha1":"054b7f2a736ee365ee5b4c071877dd4f4ac67b4a","sha256":"0fe9b1bce062d63a683bfcab9ac77eeb1f8b1ace7b0e138365a83f2a5383ccbc","sha512":"d6f9269a53168e59aad3c71b8758365a38c28f8f218356574a1508d9162bcadf842fc08ac355a769493541101fbe80ffc71ed6888821b61c4ba653b1a21f3444","ssdeep":"1536:8lAnkufieqam9UrCXBtY53xSLwFaZL7V4jwI95gq:aAnjqDUrCg53xSLwF6L7V4L7T","tlshash":"8b73f8c9f561b0e103e7a1e1803f510ba336e529704a94e4f765d9e6ae7c98d2237f38","first_seen":"2026-07-18T00:23:58.500695Z","last_seen":"2026-07-19T03:06:35.258494Z","times_seen":8,"resource_available":true,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/12.2aec0afa485313e036aa.chunk.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.551Z","timestamp":1784394601551,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/12.2aec0afa485313e036aa.chunk.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-a56\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":1438,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1681)","md5":"53e330a1e2849caea241ece506e1d392","sha1":"973b41d842452a6ebed8ff6e2b5e617c3c1e44f0","sha256":"0b31cf3c7b35b652b10f6dbb26e87767ea43735e862c1fe7e5c5e21e7a4728ad","sha512":"a0eff7dbb008ce571c5a5a797018ae4310162b4a9e90e83c4b2a96d72d6c88d691afa14a0c86e67ac60a1f81636d74edfd99c18c99bb54c0fd45ba7fa1e3efc5","ssdeep":"","tlshash":"2b51646df0e2746006ba74e4126f7783f22f9039210804c43b5ca2a07b749c3d235bf9","first_seen":"2026-07-18T00:23:58.495063Z","last_seen":"2026-07-19T03:06:35.228103Z","times_seen":8,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/OrchestratorMain.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.586Z","timestamp":1784394601586,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/OrchestratorMain.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-d033\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":53299,"size_decoded":15196,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52392)","md5":"82978809b9584ea8399f65bc70c9b37f","sha1":"985d649332c89e4084206ea1a4866bb92502161b","sha256":"88d557e7d7cc318dd380e79d6ffd921797b7266d8971aa8f55802f6a48db1184","sha512":"a400af26da49acaa0741a71aede33cc01ba793cbdcb098cbf98607d4de60da0350645ee67456726a85e93be8cbfa67416b57075b18f2efbdb91dbb0a93d5d92e","ssdeep":"1536:D6eDWucxfotNANA5ACJz81jfd1qnKPCm6:D6YWVld1qnKPx6","tlshash":"023308ce714c783d8ad62970e47f22067633213d648f84a4b54ad0ec6dbb99e4227bf5","first_seen":"2026-07-18T00:23:58.491869Z","last_seen":"2026-07-19T03:06:35.207439Z","times_seen":8,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatLauncher.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.593Z","timestamp":1784394601593,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/chatLauncher.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-569b\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22171,"size_decoded":5515,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (440)","md5":"37ee88b1fcd9a7701535dcfa6d997f5d","sha1":"2a69c449f361b14cdd67791092320d26662780fc","sha256":"84d59d0055b664e8154eb251d1848b4d036c8af53ffc70127f8a9757ffcfdada","sha512":"1d77de32d8c8bd747e9c8fbf55e76d14adf988ec4c165921d88e85573b19a34c7588c05ae82cc26d1b4301cd90dbf9d00eff44c312cbdb7d394f595a968652f8","ssdeep":"384:GXzoUqDYHN7JwvmRzWhLWkWeAhcMvupANbisqi2zfEyoikopfrPrxklWT6s:GjvqDYHNtSmRzWhLWkWeAuMSAN+I2fF/","tlshash":"88a275e5fb8d503b64a63066282f5189757c84732d04dc66fc0c58783ba4e6e913fe9a","first_seen":"2026-07-18T00:23:58.45434Z","last_seen":"2026-07-19T03:06:35.227322Z","times_seen":8,"resource_available":true,"data":null}},"time_used":232,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dls-logo-line.svg","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.603Z","timestamp":1784394601603,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/dls-logo-line.svg HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1683\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: \"6918b381-693\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1683,"size_decoded":1935,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ebbbafae5bdc09d7ded7cef405413ac5","sha1":"7a635abed6420b798397c62270d2df8b084cd8a8","sha256":"c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9","sha512":"1480a00ca3734a56e6676be44c6507c807d72fcaacc0a3846dfc04bccb37224b5b3802fc337760c71c5c9697268efd8fdb33651f80d2c49974b393b06e713cb0","ssdeep":"","tlshash":"c231aea8d340e7549c270df8de2e86b4e85e60ed92c9c344d62f8134a2e15d4f69ec64","first_seen":"2023-04-20T02:21:02Z","last_seen":"2026-07-19T03:06:35.210399Z","times_seen":1456,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dest5.html","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.477Z","timestamp":1784394602477,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/dest5.html HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-1bb8\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":7096,"size_decoded":2826,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (550)","md5":"7d089f98114796a00ce432d357d4c9c1","sha1":"7d2b01c13d0884889139703863f1b0d50aa548d8","sha256":"7ae86a2c9ed6d0fd2b26418ec4d8fa3bdb5a303772257bce9c09676132bd1c72","sha512":"c4f51d95cfcb8119e5bd791c149699c5a0dca978f7eed59b07ed10bc0fbaaf876b069efcfdfb7bcd0c2e708a72d3d637902533855e5eb6ec071ac2181271c6ec","ssdeep":"96:9nw1EOb9muLpw47eIDCpXHG5z/QkqJeMnSSyi8c2Kgn/UnNsnA2aI4j40:9Pc/xDCpX8/in/y+2KgMSA26P","tlshash":"31e1b7ce365bbc4a915a20a0717e310ab0f78964a84c6456f08ccbf15f3894f1876f6d","first_seen":"2026-07-18T00:23:58.488746Z","last_seen":"2026-07-19T03:06:35.253103Z","times_seen":8,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js","fqdn":"assets.adobedtm.com","domain":"adobedtm.com","tld":"com"},"ip":{"addr":"96.6.17.25","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.680Z","timestamp":1784394602680,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"assets.adobedtm.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 15 Jun 2026 00:00:00 GMT","end":"Wed, 30 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"F5:F4:95:3A:18:25:EB:18:C8:0C:A4:56:E7:FE:F8:C7:7C:1D:44:B4","sha256":"9E:4F:3B:F5:7A:9A:F7:87:73:7C:41:75:E3:2E:DA:1F:4E:BA:91:37:26:FC:A2:EC:77:E3:0B:0D:AF:13:18:A3"}}},"request":{"raw":"GET /98caf8fccc463fd7e47088b35e73b27720bb5cc1/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js HTTP/1.1\r\nHost: assets.adobedtm.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-type: application/x-javascript\r\netag: \"b047d275fa16655e6a02177568cb92b1:1612505766.846291\"\r\nlast-modified: Fri, 05 Feb 2021 06:16:06 GMT\r\nserver: AkamaiNetStorage\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=3600\r\nexpires: Sat, 18 Jul 2026 18:10:02 GMT\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-length: 34313\r\naccess-control-allow-origin: https://americanxpresses.com\r\nx-content-type-options: nosniff\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":107080,"size_decoded":34834,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (17139)","md5":"b047d275fa16655e6a02177568cb92b1","sha1":"2ed86ed81fb5af29bca88431b703bc90ff294272","sha256":"b0527cbec8248da53067ceaa7385cbd8159ad02008d478b666f940d738fbd56e","sha512":"0551195197d360c2666dbcdc7a3657068182d519968854481dd7b681158e687d0187df9d736de23bbd34d837129128239ad7c8091f101928c8be037e60426b09","ssdeep":"1536:Rc2ZftDcmj04jUrO3EveyMXki/+btOcoAj52T/yviM7ziy9jBHTEWKiwYim:Rc2lxcb4y72rN+bA782DiiM1EWKW","tlshash":"62a35c8a76e2146a01b720f9522f1007b13bdb971184c874bd9ce5d0afb4a6711fbfb9","first_seen":"2024-01-25T19:18:32Z","last_seen":"2026-07-19T03:06:35.211912Z","times_seen":11,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":3,"receive":2,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lptag.liveperson.net/tag/tag.js?site=14106077","fqdn":"lptag.liveperson.net","domain":"liveperson.net","tld":"net"},"ip":{"addr":"178.249.97.23","port":443,"asn":11054,"as":"LIVEPERSON","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.700Z","timestamp":1784394602700,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.liveperson.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA OV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 28 Apr 2026 00:00:00 GMT","end":"Thu, 12 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"53:57:F0:1D:16:CC:95:0C:85:D3:C0:06:24:0C:E5:99:21:88:DE:D0","sha256":"44:D9:E4:14:B0:FB:F7:9E:8D:44:0D:77:C9:E9:70:14:9A:D4:1F:0D:E4:74:A3:19:5B:91:E3:25:EF:0F:CB:C5"}}},"request":{"raw":"GET /tag/tag.js?site=14106077 HTTP/1.1\r\nHost: lptag.liveperson.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 18 Jul 2026 17:10:03 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 10125\r\nlast-modified: Tue, 10 Feb 2026 18:17:34 GMT\r\netag: \"698b763e-278d\"\r\ncontent-encoding: gzip\r\nserver: ws\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\naccess-control-allow-methods: GET, POST, PATCH\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token\r\naccess-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=630\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28888,"size_decoded":11336,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (28888), with no line terminators","md5":"eeccf27f80d19705c17b9a208a7c3815","sha1":"6ab1382fb3489e818bed878cb9a5c732483d4b9b","sha256":"1bac70cdab1f1607fb6247f8e5e133050798c52b68a84409c1813b2bcf8f1ac6","sha512":"83e61ce8838ccc2f783f68f5527acd42b309acf827819f648fc16bcc151546d8ded7c66f40f40e865e3c622477045e6e80f7398978c3e8cb2171784f2abe9509","ssdeep":"384:sMi7TkHlEBG1cCVVbO8IkFnxWjXUwzW6NJ744G1E2lgeDT:sMoGOCb68IkFnxWUwzuN","tlshash":"edd21889f78272316ab6107be1af160b61359caa6c4cc9f0e1d0e8e0797407c43a7f6d","first_seen":"2026-03-13T17:50:45.512898Z","last_seen":"2026-07-19T03:29:25.948194Z","times_seen":304,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":42,"connect":30,"send":0,"wait":30,"receive":102,"ssl":149},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatFrame.css","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.544Z","timestamp":1784394601544,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/chatFrame.css HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-46ec\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18156,"size_decoded":3826,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"82650bd01c3776e0a465060e6d6dc506","sha1":"a600a101a6b11a7cf38c9a0eb60af53f4352e297","sha256":"43cd810f097c80c86e207e3115cb4bffbda760f9001e7a8e2329afab8985919d","sha512":"b69ba5137b48e3d31c4813acabba858b55eba6893962be999fdec62b42166f23493e609aa193025994b353a8433429eb17129c62928547bbd26c7853da8e3e98","ssdeep":"384:tvMiPDVpl0fTQzGk+mizoWLmN2vzOLlccNx5cw7QdkmJESe5jg1:1MiPD3lgQzGk+mizoWLmN2vzOLlcUx5K","tlshash":"55827376e946306bf2075b7e73b667712c904263cf0b4a3d34e0ba09d3c59aa29317d9","first_seen":"2023-04-05T04:40:03Z","last_seen":"2026-07-19T03:06:35.216158Z","times_seen":190,"resource_available":false,"data":null}},"time_used":725,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":725,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatLauncher.css","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.547Z","timestamp":1784394601547,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/chatLauncher.css HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-7d1\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2001,"size_decoded":715,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"ebc5b38dbb7134c8abd266a6b6db25d5","sha1":"3c5f295ac8279c74a59667ef1a32f221f2e18955","sha256":"b0e13e8a82110e29a07ff390b4e227875081da0b7bca0ee7e580bf08be05d2fb","sha512":"5299a00339f52a28c5ac508b4e71f1e922741fcf9909b161235c8e1005ab41cf18224b800462ddfe272433a69444b88a2275082ae473515734b88df4e6483102","ssdeep":"","tlshash":"5741be30e552544f3b23c09847752a0dff06402b57d90a7cb6c445a43ffa55b89a2eea","first_seen":"2023-05-15T01:50:25Z","last_seen":"2026-07-19T03:06:35.196299Z","times_seen":15,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-global-header.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.567Z","timestamp":1784394601567,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-global-header.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-29f73\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":171891,"size_decoded":29032,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4087211800518ca80e0d04f2b7e7c7e0","sha1":"d6439c4325079d1cb0a1c96477738c2bf3b1d5fe","sha256":"208fd29ec9e8cc88a562a20635b2ce389b292739c15f87bdc20b18f187ece56c","sha512":"7509e9510359538cf813168bfd6e2c72fc1c6f6322b2882493179accfc23d4f797d0cf829d54763a3e3b8f3ccffdabb189d7e4056a65f64d89a204fb1cd369f3","ssdeep":"1536:FVeFIH/TPYeTdbeAf3o+pZ03bADQeiBiUWzPtT6ZWqDdpmyOHxhEIxpH:TOU/7isUcqI3EQH","tlshash":"3ff354c867f5724e027a359fe51b280ef79901be401d6ca3f20ee4de2cd5a9a83f1604","first_seen":"2026-07-18T00:23:58.467143Z","last_seen":"2026-07-19T03:06:35.2512Z","times_seen":8,"resource_available":true,"data":null}},"time_used":233,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/chatSupplier.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.591Z","timestamp":1784394601591,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/chatSupplier.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-7fd\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2045,"size_decoded":981,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1907)","md5":"177db1fc83565ecc050d0ac833eb9169","sha1":"1457c719b7192bc2ecf1c5262d8eb5f64e729b3b","sha256":"6f6af66a24105bf89f2801f0c810ee19a6c059af9f36255c51db12f1c8e303c7","sha512":"fcd95b9d1bfe38f5b72b3f8f22c75e7e76eca0d4c2f8b7ab9362f2d1c074251f216fd9ea02b3f15adaab0ec4eb6b78ed56be9a6f76550aed49d0bb36776cbcdc","ssdeep":"","tlshash":"0e413671750690745652742eb07f7f06a51345ba5c404fb486ddc8b43c6c9cb09befc6","first_seen":"2026-07-18T00:23:58.468164Z","last_seen":"2026-07-19T03:06:35.214015Z","times_seen":8,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dls-flag-us.svg","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.293Z","timestamp":1784394602293,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/dls-flag-us.svg HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 5624\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: \"6918b381-15f8\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":5624,"size_decoded":5877,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"56addba553083eb384b100cbb7e8632f","sha1":"f718526f1ef720e5d361536615595d5bfc3c9688","sha256":"5e60a20da0f769a6260d4ed755d615da930b87c62436f807a6ff32d000017d18","sha512":"8e25c45c3cb1c056cdbd40e83bfcae2594c4346c5664d28599c81f84d143970d02c65ea47ac2d74d35b76ac913cc28cc2bd5490283f8877b17dee63c315fe8a7","ssdeep":"96:GL5GLGGGa7GDaSFF77W87yCG++7d9iYGGeJ7G1j4GeJSAGj7GetIR747WqyCGkWW:G9PO2XHW8G7B59iYGLE8ih/gRsWP7pTS","tlshash":"35c1cd88bd344e4c1e83a5ce7f6a1ee57efca499e23fc10a561e0648d3a6741e10f9d1","first_seen":"2023-04-20T02:21:02Z","last_seen":"2026-07-19T03:06:35.195615Z","times_seen":930,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/api/axpi/ensighten/liveengage-lp/bdaas/le-mtagconfig.js","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.706Z","timestamp":1784394602706,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/api/axpi/ensighten/liveengage-lp/bdaas/le-mtagconfig.js HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nlast-modified: Wed, 12 Feb 2020 13:24:48 GMT\r\netag: W/\"5e43fca0-6dc\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'self' https://qwww.aexp-static.com https://www.aexp-static.com script-src 'self' 'unsafe-inline' https://*.akstat.io https://www.pocket-concierge.jp https://pocket-concierge.jp https://player.vimeo.com https://assets.adobedtm.com https://www.googletagmanager.com https://www.google-analytics.com https://use.fontawesome.com https://*.go-mpulse.net https://fonts.gstatic.com  https://fonts.googleapis.com https://cdnjs.cloudflare.com style-src 'self' 'unsafe-inline' https://qwww.aexp-static.com https://www.aexp-static.com https://www.pocket-concierge.jp https://pocket-concierge.jp  https://fonts.googleapis.com  img-src 'self' data: https://qwww.aexp-static.com https://www.aexp-static.com connect-src 'self' https://*.akstat.io https://*.go-mpulse.net https://*.akamaihd.net https://*.americanexpress.com  https://www.google-analytics.com frame-ancestors 'self' https://gim-qaeusw1.americanexpress.com https://gim.americanexpress.com https://cdaas.americanexpress.com;\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=15768000\r\ncontent-encoding: gzip\r\ncontent-length: 742\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285090,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1756,"size_decoded":2266,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1756), with no line terminators","md5":"375b2eabe48c53d2ddfb48ccedcdabd6","sha1":"324cda82e51a0eab0ac41d8361832c686358bbaf","sha256":"0119d3c9c9d6499e8535e8dfff1fb8d2f891fb1434280b3a185dc82f1a944e32","sha512":"003e9f9ad32bef0db9a882a2f9281d247b302aa0b9c8e87fbdf5c02fb7d84bf6050934f48b79a4b83bdd5f0020a1c52e737e136a8095f8340c4ae6efc77f12bf","ssdeep":"","tlshash":"0031ae2d7010b635445620694bbfb30bec77609a58014e643528d8fddb2ce8b19768ff","first_seen":"2026-07-18T00:23:58.506007Z","last_seen":"2026-07-19T03:06:35.231571Z","times_seen":8,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-data-layer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.563Z","timestamp":1784394601563,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-data-layer.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-37041\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":225345,"size_decoded":52045,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (43423)","md5":"6db63f423a72c7813cf37fe1f389b6a5","sha1":"1ff1159e3dbefad50cf8b8ac8c723ddf4d89b85c","sha256":"c86722669e1d385751732d9ac838a064ccfc095a9eaae53203d087d5a3376ecb","sha512":"79face2f55d89f7359282dafc086dad3a0d42c962c489da97ff258870f3cfb36a506d5d6844315c4e063cc6f06377756ea56568f50fc8f101cbaa49221035139","ssdeep":"6144:M1T/H3gbSBEO9bG/DcuHX5H7iqgMUEGwBAG:2TXY7Hwwh","tlshash":"8524d78d7a91f062439361a5403f640ff2796929a89ce490f361d8f57cf949e8327f3a","first_seen":"2026-07-18T00:23:58.479101Z","last_seen":"2026-07-19T03:06:35.233098Z","times_seen":8,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-root.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.575Z","timestamp":1784394601575,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-root.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-9dbc\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40380,"size_decoded":10453,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (40380), with no line terminators","md5":"e249b7e7f70eee79a53cee1712423338","sha1":"7106df43953ac633314af6124b202ba2740699d1","sha256":"8128a0300cc297d2ed98634f5067bad88cefd72a299f23e5f69653d7c2db51ca","sha512":"aea1c74612f0f420e6ae111af9d5656fa2de2f12b93a8db62ce2e2e6f02ae197d1ce11f1d5313292d04b180484823344c710c8322bdf53d1ad737c3981a2ab46","ssdeep":"768:Yhw9A+ymNOfezRPhCtY5Q5wUUnQ67gdyTK/Vf:HpLNOfihCtyKw5XgkKJ","tlshash":"2203d7dd7581fc92d3e321674e2f240ab0aa4d1ca44be8c7e35ae5d99c3564e0297f38","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.229858Z","times_seen":24,"resource_available":true,"data":null}},"time_used":665,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":665,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Light.woff","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.690Z","timestamp":1784394602690,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Light.woff HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 73604\r\nlast-modified: Sat, 26 Oct 1985 08:15:00 GMT\r\netag: \"1dc09d84-11f84\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccept-ranges: bytes\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285091,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":73604,"size_decoded":74060,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 73604, version 0.0","md5":"7294a33a9bec0eae9f3adddbcfe009c9","sha1":"6e2cf6a463aab5c238468b67831a30dbdf430bda","sha256":"e9f9fab2d479b79aca1d3d3bf0a9fc36131752869363180bef040905a008cc1b","sha512":"e33a9e248992deb46b7e866da6b42cc1e7075b376a806cdaf0f54146347e245c9d46201987d77c728990d87bc7b915bfe8ac3e294c6690b4704e5e99fc862968","ssdeep":"1536:QgE9M60CdM6WBCEseB94PthhYxxSJgjNeb0PJH58UFnPzpv:V6BFqmbS2q0b0BZ5nbV","tlshash":"2e7302374da1bcd6a3dab0bec8ad6bd86c258cb6f6f28f050511da7dd4e5c1a9060e40","first_seen":"2023-05-07T17:21:29Z","last_seen":"2026-07-19T03:06:35.220771Z","times_seen":245,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":1,"connect":3,"send":0,"wait":19,"receive":1,"ssl":7},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"omns.americanexpress.com/id?d_visid_ver=4.4.0\u0026d_fieldgroup=A\u0026mcorgid=5C36123F5245AF470A490D45%40AdobeOrg\u0026mid=33481947444931093357692668994922421927\u0026ts=1784394602708","fqdn":"omns.americanexpress.com","domain":"americanexpress.com","tld":"com"},"ip":{"addr":"63.140.62.236","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.836Z","timestamp":1784394602836,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"omns.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Mon, 15 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"69:A3:FF:02:44:ED:E1:2A:8D:F4:36:A3:5B:94:41:07:D8:0A:EF:2B","sha256":"67:76:85:3C:07:B7:04:8B:65:BB:52:F5:9C:70:E9:77:22:DF:80:30:7B:D7:BD:54:0E:2B:A8:67:5F:49:D1:7B"}}},"request":{"raw":"GET /id?d_visid_ver=4.4.0\u0026d_fieldgroup=A\u0026mcorgid=5C36123F5245AF470A490D45%40AdobeOrg\u0026mid=33481947444931093357692668994922421927\u0026ts=1784394602708 HTTP/1.1\r\nHost: omns.americanexpress.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://americanxpresses.com\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: https://americanxpresses.com\r\naccess-control-allow-credentials: true\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\np3p: CP=\"This is not a P3P policy\"\r\nserver: jag\r\nset-cookie: s_ecid=MCMID%7C33481947444931093357692668994922421927; Path=/; Domain=americanexpress.com; Max-Age=63072000; Expires=Mon, 17 Jul 2028 17:10:10 GMT; SameSite=None; Secure\r\nvary: Origin\r\ncontent-type: application/x-javascript;charset=utf-8\r\ncontent-length: 48\r\ncache-control: no-cache, no-store, max-age=0, no-transform, private\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48,"size_decoded":738,"mime_type":"application/x-javascript; charset=utf-8","magic":"JSON text data","md5":"1356a54246f546cd4ce319b9136d00ac","sha1":"020fa1b7eb5619c96b1cc9184466a7260f868d2a","sha256":"ca130f88430a9900807f159873583e3e46343779f09669a51cfd4bbc76f30d4d","sha512":"d25fb10ae145fb0b700f1d7db3fd6962e186e9bcd1d0f115c3fbb1d8adfa6c1522e853021d4e5cae0039f767bafb0a049067bb2fcc99b766bb0b2e8685e4d090","ssdeep":"","tlshash":"fb900410c45c140d443d033f4555d1051130117d4d414f371547d7c531cc03001dfdc0","first_seen":"2026-07-18T17:10:54.806068Z","last_seen":"2026-07-18T17:10:54.806068Z","times_seen":1,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":3,"connect":37,"send":0,"wait":42,"receive":0,"ssl":77},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.542Z","timestamp":1784394601542,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/s-code-contents-8ad4bf7f4e17c7cb9ef68ac5d6cad7bd293e1c4b.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-1a248\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107080,"size_decoded":33421,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (17139)","md5":"b047d275fa16655e6a02177568cb92b1","sha1":"2ed86ed81fb5af29bca88431b703bc90ff294272","sha256":"b0527cbec8248da53067ceaa7385cbd8159ad02008d478b666f940d738fbd56e","sha512":"0551195197d360c2666dbcdc7a3657068182d519968854481dd7b681158e687d0187df9d736de23bbd34d837129128239ad7c8091f101928c8be037e60426b09","ssdeep":"1536:Rc2ZftDcmj04jUrO3EveyMXki/+btOcoAj52T/yviM7ziy9jBHTEWKiwYim:Rc2lxcb4y72rN+bA782DiiM1EWKW","tlshash":"62a35c8a76e2146a01b720f9522f1007b13bdb971184c874bd9ce5d0afb4a6711fbfb9","first_seen":"2024-01-25T19:18:32Z","last_seen":"2026-07-19T03:06:35.211912Z","times_seen":11,"resource_available":true,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/vendors.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.560Z","timestamp":1784394601560,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/vendors.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-c557d\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808317,"size_decoded":177804,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64083)","md5":"9a5724be0330ea865ae3b361ff03d454","sha1":"eb8c27b5ff2550874850292368bafb70129dab9a","sha256":"b4d5a66919bb1b538fc20c24a261f8cc4dc1f3ae4fb73d963661690cb1ffb17d","sha512":"31d0309b0b6b46b50ba54eb70ea472624cbac436a3ab6829fa046bc887330af9c612633db7de16e75ebde364d1342bb87d2a8efb146c24d61cf54a778bcee7e0","ssdeep":"24576:fuvxR1i0qoqVOp4whaBsLmVP7r4a6hsiM:fuvxR1i0qap4whagmVP7r4a6hsiM","tlshash":"a905f6887691f4a242e351b6442f140af27a5c2cd89db494f365c8f4befa44d922bf3d","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.25025Z","times_seen":23,"resource_available":true,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-page-wrapper.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.569Z","timestamp":1784394601569,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-page-wrapper.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-2ad8\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10968,"size_decoded":3706,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (10968), with no line terminators","md5":"9308865c2e11206ec359ce89e22ace8c","sha1":"e2ab2af0e7ace463d85968b42e50deaf78a4bad9","sha256":"b6162756984a88b34a59a6fa4235486e5c594c09961c474335b8b31ddcd30531","sha512":"86a9495585dc715b0b643353ed99c57acd25cebf3f377aeb66066694762b458389466a569d902d3a7284d49f02cb27fbc6cdd98451fdd6569be23fda52418532","ssdeep":"192:Kvh3Kgh22U4vPnL4FE6+zeMdHN30ymRWqrrPJ2EBbCVo0XMJ5an:Kvha8VvPMFFLymRWqrzJ208","tlshash":"2b320ae977c0fc9a57f328adc42f0445e1659a7ee84d6881e25ec0e62479349423bf78","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.224293Z","times_seen":19,"resource_available":true,"data":null}},"time_used":173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-footer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.573Z","timestamp":1784394601573,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-footer.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-44dc7\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":282055,"size_decoded":54150,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (43650)","md5":"bdae22a3183b48e9068ed1eba2212ff1","sha1":"6e8dba63f66a1d5ba8926e97c67b9962ad128256","sha256":"aa46b2d01e0aca0990accdf7bed437a48abb72234e7dc1bd4a473dd39c249049","sha512":"0bd209fb360ba33005145002c427471e74c38eb3632259d8f1701e244db529d7029bc33625817e6d50288e8bdeae741f0f28ac5734a243b9aeddabc343aaa19a","ssdeep":"3072:2NY8iHGylWlyDD/DCD/DCDAc8NrJrriXkrlbuv5DDD2DDHot70WfJrHFP2h7G+Wf:oY8+GTyyY0Wf/DQbnw5MxM","tlshash":"ce548c282617b758e059d08bfa3739c4caa9d18a944614d29f3d4bb31fe37d2de68d03","first_seen":"2026-07-18T00:23:58.496908Z","last_seen":"2026-07-19T03:06:35.196933Z","times_seen":8,"resource_available":true,"data":null}},"time_used":634,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":634,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/Bootstrap.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.583Z","timestamp":1784394601583,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/Bootstrap.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-10efa\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69370,"size_decoded":19574,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (589)","md5":"94cdd93eba6c5b4f2247d991d18fc304","sha1":"25f1fcc99b1a68cb99ca5c5242932a9c55373d81","sha256":"86729b57f478bcd631b9d993d9df798aa7cdd3ab5cc3ae265ea6318aa80f2bbc","sha512":"2fe67b6a583e20dc46a3dd65a1a22882adab4af1c2e4fafdf0c82c96c3be2ca231ac30635bc5fa84b9e525651f210af73e1b45e7b8c08286e409d78094072a42","ssdeep":"1536:iGU40YuIqGk+o1egm8sRIuiClrcsX5QrF0hVHtcCgVzU7P:JFkegm8KHGsHW8P","tlshash":"9863198833527562c6db30bc90ff420a71b39969b9895815e148e2d87d34e4fe27bf9c","first_seen":"2026-07-18T00:23:58.446735Z","last_seen":"2026-07-19T03:06:35.225245Z","times_seen":8,"resource_available":true,"data":null}},"time_used":637,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":637,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/global.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.587Z","timestamp":1784394601587,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/global.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-2c6e\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11374,"size_decoded":1956,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (11003), with CRLF line terminators","md5":"b88d3252d3046c932db844e6e45ddb3c","sha1":"c5bd4037ba4a9130bb783b01131c5276cdf64f33","sha256":"2f491795582931c1d31512782dbb3d39a854b62700c6949a9de0b17e17cae64c","sha512":"4ac8de2656652015b87aa43ca5c4f84e78cc369445fa5fe64ebe2ae75c30aa6a3ce4c64912c7e8076131d0c934de25d4ee43429bdd00fba9d7376a0752b0a2be","ssdeep":"192:io3TvDv9vzvbWvr9iDo2nBco0r93MvHvQR+WrftgmvIIxgKjnRQWDzKfuRt37Pi:9JcKmho","tlshash":"8b3279090b3024cdc1ea137db99e878091a595fdeac2592e53ce1b1c5f2885b33fbd86","first_seen":"2026-07-18T00:23:58.505115Z","last_seen":"2026-07-19T03:06:35.226225Z","times_seen":8,"resource_available":true,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-marketing-offer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.535Z","timestamp":1784394601535,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-marketing-offer.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-18c4a\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":101450,"size_decoded":30383,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64610)","md5":"de12733ec20534bf1509927916b22d4b","sha1":"be50049a109fb6399ba1f99c229332f1f072b1c4","sha256":"a5c2e0644898a294333940f69057849e1843578059b94275824955b12d9f6941","sha512":"7d10f345fda6ec9e3a01a68130a0a72061d69108a2c8aa31b684db2ceb6698cd162aba4e6576be16c368e40cd5e8ab8573af7857ecb81205e525e23c10604919","ssdeep":"1536:t6PbdWMntU5t/kYcoubihsz9nWxnoY2hZo:QUjGz9n0fUZo","tlshash":"c4a3c6cc34e3f056a3e7257a003f140bf2396da9689d8404e655e8d8bcb961da37fe19","first_seen":"2026-07-18T00:23:58.483788Z","last_seen":"2026-07-19T03:06:35.248905Z","times_seen":8,"resource_available":true,"data":null}},"time_used":536,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":536,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/app.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.578Z","timestamp":1784394601578,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/app.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-3277b\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":206715,"size_decoded":48508,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6c42ebab4362e6c83ecba44fe44bb58b","sha1":"e6c2190e6c28469bea57562051e05737b0d39613","sha256":"08b55c9f436769b1b028f485c57f59b645c046eefc9e96134cfa43750f3d2fd2","sha512":"15236b251950721fda5d54436a7b885e0fe6d4bd7eea3dd285c7557364571e1b2e5f0fdf08180b92f10515e35b22ecd38ef179f0240ff7d730ab80b645dd79f1","ssdeep":"3072:5yCOKGEDtFjEcgBo/g3GoskfGlCe/sffvel:9Acwo/gCkelB/+vel","tlshash":"bb148488fb99b17b13d22650005f500bfa3d9e99e8194589b396c4e7acf8d4cd0a6f3d","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.204032Z","times_seen":23,"resource_available":true,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/cc.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.580Z","timestamp":1784394601580,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/cc.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-92a7\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37543,"size_decoded":14322,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (4762)","md5":"9e7df8358ea00a363619e17142b88e5e","sha1":"c186c442edfcd79bdde139ba73679aac939c2ac6","sha256":"f88f676bbc1b598f65308c853774dbd758a5da5cbe2c4e7aef5327e79fea64aa","sha512":"c941bd6e7fe37ce8a7a43ed2d4469ab14253aab55cf90d442bd96315474f449b11a3578a0313bcfac3fa34a448d8e56e22dcf28596604ae6f08398c5dca30b8d","ssdeep":"768:45GfLqBHF+Ml48iYYY5SbKgvB/+l9yX9OnZA7:BfL2QtYYYyK60y8g","tlshash":"05f25c89323231295237327a667f730ab0764651dc02dc80a4f9cde4bd68e9b1277fe9","first_seen":"2026-07-18T00:23:58.487328Z","last_seen":"2026-07-19T03:06:35.208014Z","times_seen":8,"resource_available":true,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/serverComponent.php","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.588Z","timestamp":1784394601588,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/serverComponent.php HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 218\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":274,"size_decoded":449,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text","md5":"3d9216b661b13a03b641368674039ca2","sha1":"1e11bbe1e0f8a5e3c79061773159beb5bc0fdde3","sha256":"eb58627c753972d9868bc1b908e51c278bdd05a5a2db988d53134ca96aba34b3","sha512":"98d63e6d1b019f18282a92a4c41aff9095edeec8587e436e2852ee9a79db495822a856693d88a1256e5b62da225be92f618c7f473ef9739c3c9f8a204426207e","ssdeep":"","tlshash":"c7d02b0207783ea1814ad17c78cea39a8260043ddcd0134cc3cfa2080f588c37aab635","first_seen":"2026-07-18T00:23:58.499694Z","last_seen":"2026-07-19T03:06:35.217246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":432,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/851e5fe8de30f98cab761711f92a5f05.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.590Z","timestamp":1784394601590,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/851e5fe8de30f98cab761711f92a5f05.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-5b97\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23447,"size_decoded":3652,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (781)","md5":"6924a044d2e8d802a6db99d9cd9fe68d","sha1":"581122769c06df40c53e821f2c7841755b495a7b","sha256":"d9296a01b4d1232c0f781428e5671860ff375ff623b2b0dbcb72dc53ffe86311","sha512":"75499756170b06d4f3d8c01e1676d31bc9f4c6d8732f542fb6172eb9871a004b659d43568cba294ac2129308014702650b8ab22dade158aa59b618ec890d305a","ssdeep":"384:M1Nr7ke12ONLT2GTjIfN+ttI0MLFpAqcNhjTK:M1N39NLNABpsLG","tlshash":"45b2a7964b20719963f10a2e3b1f7705a2b304f60a81c178868d5a387f9968bd77f5cf","first_seen":"2026-07-18T00:23:58.51135Z","last_seen":"2026-07-19T03:06:35.199912Z","times_seen":8,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":400,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/saved_resource.html","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.475Z","timestamp":1784394602475,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/saved_resource.html HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html\r\ncontent-length: 245\r\nx-accel-version: 0.01\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: \"111-643a529126480-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":273,"size_decoded":572,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"775a297034938df77bc0cdfbf5922e50","sha1":"55c073c281cf74e80f70b1fefd3cf873386cf466","sha256":"a6be40f2ff5696bcc32949a9e53e39d44adcd8a6fd166a0e7c458343659bbcb5","sha512":"d59ed51f75669e083226874107e12da86b4aa3b047e4c256bcfd8155392d2c8efb581e0e28db6575c8a21a946b97262d8730242e9e743347e0a725095c5f24a2","ssdeep":"","tlshash":"3bd02bbbe417111655382ad65ac97d0a5a11d265b006988a80d834fcf1dd70ed463586","first_seen":"2026-07-18T00:23:58.50771Z","last_seen":"2026-07-19T03:06:35.256944Z","times_seen":8,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.ttf?v=5.10.1","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.695Z","timestamp":1784394602695,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.ttf?v=5.10.1 HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/ttf\r\nlast-modified: Sat, 26 Oct 1985 08:15:00 GMT\r\netag: W/\"1dc09d84-14330\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\ncontent-encoding: gzip\r\ncontent-length: 35488\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285085,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":82736,"size_decoded":35947,"mime_type":"font/ttf","magic":"TrueType Font data, 11 tables, 1st \"GSUB\", 16 names, Macintosh, type 1 string, dls-iconsRegulardls-iconsdls-iconsVersion 1.0dls-iconsGenerated by svg2ttf from Fontello project","md5":"200b9031dfb14bfa8b184a2f4f086cfe","sha1":"1e1bb8e914ff7d6888fd08dfd0931741ebc5800d","sha256":"4c4be06660195f1e859bd08c245a43838a97206465a68a17d7e2ddf726b8ddb5","sha512":"8904151a28f63f7b1301f5f320f1eceb1cb4358e0f30c21af0547879dc7ac8798aed983cdfe4db1a076dd9c92370ddb48a6faa99d1cef86c4b03ff7886402014","ssdeep":"1536:5CorVviWZAJPzTzF2IGGEmptqmSQcyaD4oyu8nGhrwhzxjg92OaH9WiLrVePSp4c:KaAJPzTznGGEMtqmS/D4oyuphcxjg92z","tlshash":"7a834bae53564fbad77441bd0854522322b3e502e78cfdabee462849b1313db07e8727","first_seen":"2026-07-18T00:23:58.489705Z","last_seen":"2026-07-19T03:06:35.230767Z","times_seen":8,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T17:10:01.158Z","timestamp":1784394601158,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":274108,"size_decoded":44811,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":43,"connect":23,"send":0,"wait":43,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/en-BB_i1_a1e63395.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.530Z","timestamp":1784394601530,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/en-BB_i1_a1e63395.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-4993\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18835,"size_decoded":1612,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (18835), with no line terminators","md5":"3b1953b99cf516c88dafda47110c6cf2","sha1":"db3aa23f228e8240f6859d0538be88b11cf902f8","sha256":"484d27df06c0a43ca47a5fb2d89458b08816a3b697e33452d633a73d8c85dc93","sha512":"7f46ad66fe7d1918f804706e70187c64d608e8a972b06ab492df6e028c7fa7155b77ae671f70f914111405e34c81cd1a1f3714aa22c55870fd5be5867778f0da","ssdeep":"192:85p/egEH7uEt6EtXElxiMs8sVAyfEt1i1:t7bfGDs88ABW","tlshash":"5882485bde430fff0d7d6fc506231346351a1aa9488e0b20b97af50a3b5ae6c16ec1b5","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.205211Z","times_seen":9,"resource_available":true,"data":null}},"time_used":523,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":523,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/tealeaf.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.584Z","timestamp":1784394601584,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/tealeaf.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-161ca\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":90570,"size_decoded":28777,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65275)","md5":"b53944527041b52c88a5a5ffb88c1ba9","sha1":"20de879d0a3804ad8aa5a16f854bb553ba6d1d65","sha256":"d2e62e9e3fe81151b8b0fab489e81db18be5471adfd2220b31f9fbe1873c6a4e","sha512":"b923e7835737ba4d985cec52803b0015ff900bee7fedf77d7b5cff86598ba18e938c6d6ee01a40fb7cf018a34ec270a23beada8212d1eeaf76f40625bb632ce6","ssdeep":"1536:eoMQ12cwAa/V9gceW/Ymlxt/tBJPGY+hmwKQE+Ln8u6L5exJFGpIdNYhoPA:MILegHgtfUGpsNYWI","tlshash":"63932a5933d234b64aeb2030816f2607b53856e3594d6060eab8d4e17cf8c8f957bfad","first_seen":"2024-01-25T19:18:32Z","last_seen":"2026-07-19T03:06:35.254986Z","times_seen":11,"resource_available":true,"data":null}},"time_used":628,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":628,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/qualtricsIntercept.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.585Z","timestamp":1784394601585,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/qualtricsIntercept.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-a85\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2693,"size_decoded":1375,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (2693), with no line terminators","md5":"d9231fa034917dae2dc3fea2b619469f","sha1":"c04d852ca0c13c32d2ee29f102429d7e3cd094dc","sha256":"f6ba7b956784868505c5d2dbbaf7394bf429ea5f787b6f3871c46f64c5d20402","sha512":"8143f5d920a80bec3a3f61422142d50ff0d436bd77fd481d1c3d1888b08480b6a6652e0a5686ca303db6c2811a3d8fd262b02c3774e842d07ca692421ab3ed3a","ssdeep":"","tlshash":"295196f530a4bd300382b0d8423f5206f0771ea620d975c8e555e6a1bd2085fe1e3fb6","first_seen":"2026-07-18T00:23:58.49868Z","last_seen":"2026-07-19T03:06:35.252078Z","times_seen":8,"resource_available":true,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/s47298452822740","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.522Z","timestamp":1784394601522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/s47298452822740 HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 16 Jul 2026 22:25:56 GMT\r\netag: W/\"328-656c1ec8269d7\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":579,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-19T03:06:35.200557Z","times_seen":38342,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/tag.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.549Z","timestamp":1784394601549,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/tag.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-5494\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21652,"size_decoded":7483,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (21652), with no line terminators","md5":"e2ee8a9cd68c3d310a4c62fdb4b5c93a","sha1":"67eb5f9547f1d9de0a8b143c3b50511c26281399","sha256":"145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7","sha512":"4cfee56ca068134354be94127465e9aa7bfd8f68e0d2b6d6a367c0e9eaca5cdf5fc39290f6c1cb3dd4dc9319b60a38f810f220ad836c94fedc991ae17eb82159","ssdeep":"192:speXIcO8AiGMXMGc1IajSFkhChE7KYHliXMvjmPc3l7jcCVVmF6Q+3vMjT8LEc6q:sp63F4M3jFkfHlHL91cCVVbO8IkFAjl8","tlshash":"8da2e885f38632326ab9213ba0af170b6075d9a67c4c86f1d194ece07d7547c02a7fad","first_seen":"2023-03-07T01:02:45Z","last_seen":"2026-07-19T03:06:35.259385Z","times_seen":177,"resource_available":true,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-one-seo.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.565Z","timestamp":1784394601565,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-one-seo.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-66f8\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":26360,"size_decoded":8988,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13731)","md5":"4fe732deecd7b4264e7e19ff8f9e01ad","sha1":"2fda2e2634e94a10a475a1c17edaf8623494a1f6","sha256":"7996affe33bccfb8f2706f8f81b0d93b41e550d2f83aa74db8bab9ed9df30859","sha512":"f82feb651854b413e8b0a608bbb8ac2f183ec10915a97690acf01e6ff1fa17834fbcfb658a2e8d758ad9c0ec38ecee8ca13f325fee7a601db5f0ad7fa36c7083","ssdeep":"384:85cXkwyPYt/pRxnSpWTiw5CG2wOyd4eyq+veTRCJj/5cMMtJbsyzTb:l9nAWwwOmmeQ2J3Tb","tlshash":"c0c2e58cb5a1f8a607a225e0042f614bf27e092ea4ada8d5f750ddd1acf4d5e4137f38","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.206913Z","times_seen":23,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../fonts/Roboto-Regular.woff","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.337Z","timestamp":1784394602337,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":274108,"size_decoded":274294,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.685Z","timestamp":1784394602685,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 37153\r\nlast-modified: Wed, 15 Aug 2018 20:46:09 GMT\r\netag: \"5b749111-9121\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\nvary: Origin\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccept-ranges: bytes\r\ndate: Sat, 18 Jul 2026 17:10:03 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285175,c=g,n=NO__OSLO,o=20940],[c=c,n=US_NJ_EDISON,o=20940],[a=91,c=o]\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":37153,"size_decoded":37631,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 37153, version 1.0","md5":"c0e3b5653c803f69c05862736a765e4a","sha1":"4ae2328614d48c62388c8409cbd1d9e7b5d4dfda","sha256":"48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad","sha512":"d839eda84c5be3abde6eb1b1405f92d4975534568053d19ba8ae219b8044584fdd3c918f32c903f52cf0a421c9c896ec8292316e8387baadf6009b557084edf7","ssdeep":"768:fWDPxSfGL0pYHrHFKbxD9BsFJB3X42pvRFRR77PO6Nv17Zmp+RzwJhH/zwA9:fCPxSfGL0qRODU9HRJ9xTOINmp+RzQh1","tlshash":"a2f2e1010c78f8da988de04b5f71e37b47eda4aa47cf5418479d9c0848dfb7ea570a21","first_seen":"2023-05-11T18:50:33Z","last_seen":"2026-07-19T03:06:35.218237Z","times_seen":1423,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":227,"receive":9,"ssl":211},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Medium.woff","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.686Z","timestamp":1784394602686,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Medium.woff HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 72956\r\nlast-modified: Sat, 26 Oct 1985 08:15:00 GMT\r\netag: \"1dc09d84-11cfc\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccept-ranges: bytes\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285176,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":72956,"size_decoded":73412,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 72956, version 0.0","md5":"ba8101d8a4e5a90bd9d07a05afd8466d","sha1":"f616f6471fc3c3badb3cb8b693d4329deb2e2d3b","sha256":"d5d7822393d3103ec421f72f09c7f7c78948c68da112031c0afd1c0b0da92c08","sha512":"ede42ef3a16e2a981cc8411beb437a0a420096cec1e9811dee8387ee153c9bbf7c8695b41b1a6e6e40d6ea093badd6eeed4aec6871252d58c4f0af393fbf5d58","ssdeep":"1536:KW1S2PMAHUhFKguh6F9uF3iTBvOFMvSGMAN9BGsi5tzHynSf69Ku9X2YEiqYK:KW1S2pHUCoaSFvOF02AzuTFfyKpjYK","tlshash":"9563021efb99c474202ac9360836fe8eba21a977e69038c125d075dc570266f6734fda","first_seen":"2023-05-07T17:21:29Z","last_seen":"2026-07-19T03:06:35.226831Z","times_seen":286,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":3,"send":0,"wait":27,"receive":1,"ssl":213},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/api/axpi/ensighten/oneapp-webanalytics/global.js?vr=1.0","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.702Z","timestamp":1784394602702,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/api/axpi/ensighten/oneapp-webanalytics/global.js?vr=1.0 HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nlast-modified: Wed, 11 Jan 2023 07:23:12 GMT\r\netag: W/\"63be63e0-4572\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'self' https://qwww.aexp-static.com https://www.aexp-static.com script-src 'self' 'unsafe-inline' https://*.akstat.io https://www.pocket-concierge.jp https://pocket-concierge.jp https://player.vimeo.com https://assets.adobedtm.com https://www.googletagmanager.com https://www.google-analytics.com https://use.fontawesome.com https://*.go-mpulse.net https://fonts.gstatic.com  https://fonts.googleapis.com https://cdnjs.cloudflare.com style-src 'self' 'unsafe-inline' https://qwww.aexp-static.com https://www.aexp-static.com https://www.pocket-concierge.jp https://pocket-concierge.jp  https://fonts.googleapis.com  img-src 'self' data: https://qwww.aexp-static.com https://www.aexp-static.com connect-src 'self' https://*.akstat.io https://*.go-mpulse.net https://*.akamaihd.net https://*.americanexpress.com  https://www.google-analytics.com frame-ancestors 'self' https://gim-qaeusw1.americanexpress.com https://gim.americanexpress.com https://cdaas.americanexpress.com;\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=15768000\r\ncontent-encoding: gzip\r\ncontent-length: 3077\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285086,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17778,"size_decoded":4603,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16312), with CRLF line terminators","md5":"c7a3129f6cc7d7cd377430bde98ef421","sha1":"1c76f48d80e2d212a2846ab2a5b643d37f4d48b1","sha256":"bbd301222c05fb19f6bd610a880353298d29f0b517a21d8dc2a9ccccb1eaa75d","sha512":"0fa75f6aa93caf30a912c61bcc10f8316cd9dc5e8d52444fb114e5f0fdda372936fa187093a349b2e0edd767221ccfcb6d8f91a3815e6b48d015b850c7b73a84","ssdeep":"192:IP9SI9sS63TvDv9vzvbWvr9iDv13o382nBco0r93MvHv0v3vevDE6z8mkCR53Kg5:IPbGmlXRXONgf0Z9g","tlshash":"6a8299090b3024dd80e9137db99e974091a695fdeac2582e53ce1b6c9f2485b33ffd85","first_seen":"2023-11-15T23:52:43Z","last_seen":"2026-07-19T03:06:35.25753Z","times_seen":13,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/iconfont/dls-icons.ttf","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.895Z","timestamp":1784394602895,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/iconfont/dls-icons.ttf HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/signin_files/dls.min.css\r\nCookie: AMCV_5C36123F5245AF470A490D45%40AdobeOrg=1585540135%7CMCMID%7C33481947444931093357692668994922421927%7CvVersion%7C4.4.0\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 16 Jul 2026 22:25:56 GMT\r\netag: W/\"328-656c1ec8269d7\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":579,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-19T03:06:35.200557Z","times_seen":38342,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/info_files/favicon.ico","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:03.350Z","timestamp":1784394603350,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/info_files/favicon.ico HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nCookie: AMCV_5C36123F5245AF470A490D45%40AdobeOrg=1585540135%7CMCMID%7C33481947444931093357692668994922421927%7CMCAID%7CNONE%7CMCOPTOUT-1784401803s%7CNONE%7CvVersion%7C4.4.0; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:03 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 1358\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: \"6918b381-54e\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1358,"size_decoded":1621,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"974ccc6c4c6e1c7f04606973beb3ba20","sha1":"0f96f86d488a4b5805744fa067c3cfd57c928406","sha256":"265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0","sha512":"76c59e26ffb29e6f7598c7cb4494a91506ff1ed43cddd22caf0501f44589d4c931aa48e5dabdfe2c719cf4c9d5f0eafae6dde7f109330327fccb0c500c28ac26","ssdeep":"","tlshash":"c12186c9572a15023dd5ebfe0d570583a1e6bcd6f48233962adf2296b1c094a3c9911d","first_seen":"2023-04-05T04:40:03Z","last_seen":"2026-07-19T03:06:35.194984Z","times_seen":6516,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-1.ttf","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.693Z","timestamp":1784394602693,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":274108,"size_decoded":44811,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../fonts/Roboto-Light.ttf","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.697Z","timestamp":1784394602697,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":274108,"size_decoded":44811,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/app_vendors.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.557Z","timestamp":1784394601557,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/app_vendors.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-fa8db\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1026267,"size_decoded":211643,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (40983)","md5":"bfcf94af3b9f6d451b6b0e93b7a42bba","sha1":"3da0c5529395e93d28394cbc0de5e7e5ccab2d43","sha256":"b879b6e86af81143065ea342561907c61a102a14a7e0890d3c8723b3500c6b53","sha512":"c44f21b4031d9270b6fd28242cc3e4b2fef67b0e5ce982a95402234808b124bf465ddb0b4a2075e363b5e49a60f6b1c2b7392965655a40352a3cb50872480ecf","ssdeep":"24576:w0lOuhNwEgkLkVmPNJr7dwWQoC1qTn072fTaI0jSiq3akmWnMqAW0gNfBmvKl8ZV:w0lOcNwEgkLkVmPNJr7dwWQoC1qTn07N","tlshash":"6725d6c97291f8670fd310b0803fa50bf27a587b244e9960e611dde9bcba15dd227f29","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.254121Z","times_seen":23,"resource_available":true,"data":null}},"time_used":623,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":623,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/CoreModule.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.592Z","timestamp":1784394601592,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/CoreModule.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-19b1e\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":105246,"size_decoded":31130,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (64771)","md5":"e62351b87de1e81c67f88334a5888b53","sha1":"62a5f7ce04b54a4e93017ce4c47f1aefc5f3959c","sha256":"8b0ddf8a0f2b229a15eff81a8af8ff67d6593b86bb7405f598b6db8d61b6375a","sha512":"3d3b3e0e83d055a75295b265685054792554ab9125b478492f539af22b15985e00fd6f1647a85be98c52bc38e863db0543c1827fc5375375e11c8c4514f3f04a","ssdeep":"1536:5smxI9zSgwNqInTG+nNO/rx/MYpH+EOaxvKRvDo8jl:dNnyoYEEOaxvKVDo0","tlshash":"3ba3188db182b96947e731b0913f220af13b11a8258d40a8b529c5d1bd7698fd237ffd","first_seen":"2026-07-18T00:23:58.461723Z","last_seen":"2026-07-19T03:06:35.209446Z","times_seen":8,"resource_available":true,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":360,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/one/qualtrics/1.34.0/OrchestratorMain.js","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.667Z","timestamp":1784394602667,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/one/qualtrics/1.34.0/OrchestratorMain.js HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nlast-modified: Tue, 20 Oct 2020 20:52:26 GMT\r\netag: W/\"5f8f4e0a-d033\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'self' https://qwww.aexp-static.com https://www.aexp-static.com script-src 'self' 'unsafe-inline' https://*.akstat.io https://www.pocket-concierge.jp https://pocket-concierge.jp https://player.vimeo.com https://assets.adobedtm.com https://www.googletagmanager.com https://www.google-analytics.com https://use.fontawesome.com https://*.go-mpulse.net https://fonts.gstatic.com  https://fonts.googleapis.com https://cdnjs.cloudflare.com style-src 'self' 'unsafe-inline' https://qwww.aexp-static.com https://www.aexp-static.com https://www.pocket-concierge.jp https://pocket-concierge.jp  https://fonts.googleapis.com  img-src 'self' data: https://qwww.aexp-static.com https://www.aexp-static.com connect-src 'self' https://*.akstat.io https://*.go-mpulse.net https://*.akamaihd.net https://*.americanexpress.com  https://www.google-analytics.com frame-ancestors 'self' https://gim-qaeusw1.americanexpress.com https://gim.americanexpress.com https://cdaas.americanexpress.com;\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=15768000\r\ncontent-encoding: gzip\r\ncontent-length: 15788\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285084,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53299,"size_decoded":17315,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (52392)","md5":"82978809b9584ea8399f65bc70c9b37f","sha1":"985d649332c89e4084206ea1a4866bb92502161b","sha256":"88d557e7d7cc318dd380e79d6ffd921797b7266d8971aa8f55802f6a48db1184","sha512":"a400af26da49acaa0741a71aede33cc01ba793cbdcb098cbf98607d4de60da0350645ee67456726a85e93be8cbfa67416b57075b18f2efbdb91dbb0a93d5d92e","ssdeep":"1536:D6eDWucxfotNANA5ACJz81jfd1qnKPCm6:D6YWVld1qnKPx6","tlshash":"023308ce714c783d8ad62970e47f22067633213d648f84a4b54ad0ec6dbb99e4227bf5","first_seen":"2026-07-18T00:23:58.491869Z","last_seen":"2026-07-19T03:06:35.207439Z","times_seen":8,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":18,"connect":1,"send":0,"wait":21,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"iwmap.americanexpress.com/monitoring/info?preflight","fqdn":"iwmap.americanexpress.com","domain":"americanexpress.com","tld":"com"},"ip":{"addr":"139.71.113.137","port":443,"asn":6307,"as":"AMERICAN-EXPRESS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.709Z","timestamp":1784394602709,"http_version":"HTTP/1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"iwmapapi1.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert EV RSA CA G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 27 Jun 2026 00:00:00 GMT","end":"Thu, 12 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6C:21:12:63:93:EF:9A:57:26:7A:77:93:E5:7C:B5:31:E0:CB:F0:90","sha256":"ED:BA:6E:B2:12:18:24:0D:75:D6:60:8B:E6:E8:64:9D:46:E3:82:33:05:32:B5:E5:D9:DA:CB:D7:13:D7:85:11"}}},"request":{"raw":"GET /monitoring/info?preflight HTTP/1.1\r\nHost: iwmap.americanexpress.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://americanxpresses.com/\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.0 404 Not Found\r\nServer: BigIP\r\nConnection: Keep-Alive\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"F5 BigIP","description":"F5's BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions.","website":"https://www.f5.com/products/big-ip-services","common_platform_enumeration":"cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:*","icon":"F5.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":84,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T03:20:33.261029Z","times_seen":17355136,"resource_available":true,"data":null}},"time_used":895,"timings":{"blocked":-1,"dns":34,"connect":173,"send":0,"wait":173,"receive":0,"ssl":514},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/s47894660907707","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.525Z","timestamp":1784394601525,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/s47894660907707 HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 16 Jul 2026 22:25:56 GMT\r\netag: W/\"328-656c1ec8269d7\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":579,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-19T03:06:35.200557Z","times_seen":38342,"resource_available":true,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-error-message.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.539Z","timestamp":1784394601539,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-error-message.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-84e4\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":34020,"size_decoded":6925,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (34020), with no line terminators","md5":"38628cfd41064efd337a1b9938021b53","sha1":"841b4189c5e5aff7463cd6ddd4dd90d5890a7d87","sha256":"71f9cc0171c24caa1c85eb3acf8c41a3e4b4f2303a37d83850df47b9c86bdf64","sha512":"6d1f7355aac6cf968965de95ed2352fc74d594162d2613871dcd7f07f75aebed79f55bf5b3c3612341dd55ec23917821e4e8c0d32079c2b41bd439cbc5834e27","ssdeep":"384:jGTTgDmmNUnzFqcFAZZAcCWUu23ZzHnA6S:yTTg3z23ZzHnA1","tlshash":"1de221ea72bada0f83d3293f78573d44fd660b0809a3a457f30d4c884bd28660f5ab55","first_seen":"2023-03-07T12:58:08Z","last_seen":"2026-07-19T03:06:35.206509Z","times_seen":9,"resource_available":true,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/runtime.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.558Z","timestamp":1784394601558,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/runtime.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-39c3\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14787,"size_decoded":4946,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (14787), with no line terminators","md5":"a826f5aa3b4bb6ed8d2b395903b56e8d","sha1":"e05903f4e565034d21588697dcda954e99d6c943","sha256":"cade1e12dd7bc1876f6d3840bc47d28c6ea956cf597d201924a1e7524e5cc983","sha512":"e91b419fc29e8a387c0d8ba4066f58d31e508e29681570f88d0167b483e961cf0642100d00cd61f5a6f1edf71a4b5995f23c4137f9ca99c5b6b6c3090973236a","ssdeep":"192:r8fsvXrfhCpKwUczfmELq8DoCJZsbkHW6mzLl/2ZBmNh9/D8TVvxcchzLydil4kG:aHNnBhb8UbNYWP2pZ","tlshash":"ff62fd6cb8bad4da0354b5f0ac00b5e9b516712c7cc0e91bbf9c8d65a29cac8f1ed570","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.216663Z","times_seen":23,"resource_available":true,"data":null}},"time_used":677,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":677,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-login-alert.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.568Z","timestamp":1784394601568,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-login-alert.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-a6d\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2669,"size_decoded":1283,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (2669), with no line terminators","md5":"f67f8b0f30a10f47ec219265b3f87a95","sha1":"f4db2de9d5d2b4daf4e135a5199f58a6b22bc937","sha256":"cb299551b79248f1ebf017b22aa9023ba69df834545562a624b0d5f1f089da3e","sha512":"04874ec30940e1337cfd5bb6ec484b163df41cf19f9490b425e3bd68091b1572b218924af2acf2fa2065bd0627a3127c2889e9af4ad2ce811cfc811cb2cf8555","ssdeep":"","tlshash":"d55100c93680fc8633f620d4400f2525f06bc8236569b882eb658dd8bce505ec379abb","first_seen":"2023-03-10T09:25:21Z","last_seen":"2026-07-19T03:06:35.234062Z","times_seen":13,"resource_available":true,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-search-box.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.577Z","timestamp":1784394601577,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-search-box.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-236ba\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":145082,"size_decoded":38794,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (56222)","md5":"4dd1d4eadef3af3cc2e08b0dff12b0e3","sha1":"0e32973dd58fbf96f2f93d5e3f5e8671c34a4149","sha256":"3d030cb67cffc32a02534cf1117fc9b1091fd1285255b1f4f3de1c5aab42df8f","sha512":"c6e037f5558e6bc941967ebb832ecee6f7b37c2c421352e261f3e4d3f4aced84b96bc317d7731c907bf9cd56a0a784412ee828ec435a16e69a14c153e9e1e636","ssdeep":"1536:dLlm1EAo2nSW7Q55RU/81mga+mJ5n9WYOaehIRRuhm637/gZdYbDqw2iyuJq9PAM:dLEoVl5U/81mgI7n0YOkigsvP2iYYM","tlshash":"bae3f7dd7590b46207e322a6402f260bf33919b8584d5441f769d8f92cfac9e8267f3e","first_seen":"2023-03-07T15:25:42Z","last_seen":"2026-07-19T03:06:35.202957Z","times_seen":23,"resource_available":true,"data":null}},"time_used":524,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":524,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/satelliteLib-d900a4871c4036e18e47cec789c6f0682dabdb44.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.582Z","timestamp":1784394601582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/satelliteLib-d900a4871c4036e18e47cec789c6f0682dabdb44.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-2969b\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":169627,"size_decoded":45999,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32764)","md5":"d19c4c5cd290a3149a524c9b62ee9aa4","sha1":"c65f60fc58c2d00fb78fc5e4d874cfab353f7aa7","sha256":"6ffdb982ada5a7ed0527e5562bd25a313ee12c9923a7491159bfac0bd232364f","sha512":"aa21c0c75bfac21a6633aff75698e0cbef842f69cc160e275079fc0591aa62c191d30f2a7508898e319f4e6ff28f89d2cac99f1c8681af139d43530ed3c39d69","ssdeep":"3072:7QU97fid4TZ0MfTtQ1tffmiSMWNjbJjkIogo3RrDxg4AcBVxMBAi9SZdlfKM/dMs:8Iht0G8xmhNjtjkIogo3RrDxg4AcBVxj","tlshash":"e9f30a8e72f1705d52d62079403f610bb23beea624cdc070b6a1acf45db495e6266fbc","first_seen":"2026-07-18T00:23:58.472888Z","last_seen":"2026-07-19T03:06:35.247408Z","times_seen":8,"resource_available":true,"data":null}},"time_used":686,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":686,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dls-flag-us.svg","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.601Z","timestamp":1784394601601,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/dls-flag-us.svg HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 5624\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: \"6918b381-15f8\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5624,"size_decoded":5877,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"56addba553083eb384b100cbb7e8632f","sha1":"f718526f1ef720e5d361536615595d5bfc3c9688","sha256":"5e60a20da0f769a6260d4ed755d615da930b87c62436f807a6ff32d000017d18","sha512":"8e25c45c3cb1c056cdbd40e83bfcae2594c4346c5664d28599c81f84d143970d02c65ea47ac2d74d35b76ac913cc28cc2bd5490283f8877b17dee63c315fe8a7","ssdeep":"96:GL5GLGGGa7GDaSFF77W87yCG++7d9iYGGeJ7G1j4GeJSAGj7GetIR747WqyCGkWW:G9PO2XHW8G7B59iYGLE8ih/gRsWP7pTS","tlshash":"35c1cd88bd344e4c1e83a5ce7f6a1ee57efca499e23fc10a561e0648d3a6741e10f9d1","first_seen":"2023-04-20T02:21:02Z","last_seen":"2026-07-19T03:06:35.195615Z","times_seen":930,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../fonts/Roboto-Light.woff","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.340Z","timestamp":1784394602340,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}],"data":{"size":274108,"size_decoded":274294,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/dls.min.css","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.526Z","timestamp":1784394601526,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/dls.min.css HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-5655a\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":353626,"size_decoded":43060,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4bd9811ba7caedefaf1d5b4d348b5402","sha1":"61de1ffedee8e64b1b383710f42eb9539aa0fe85","sha256":"3488e209e7ecf29039fda4dfc5a98bfabb7a682c79bdb0d3e848dc5509fdc776","sha512":"1bb8a9c2b93b9da9afc6f3e3cb89ec7cdfda6162780aaf3dfbf1c1b6bbfa04bb12d48fc5e5541c1d2b1f1816bf178889748bf60779852a4ef6fe10e3e67d442e","ssdeep":"3072:BDT+we4SMAqM8wgSF9F17JLB3opAZ8Z5H7F0f:JT+we4xwgSF9FRJLB3opAZf","tlshash":"f874c796fa90305ce223c552d2d0bbb8762b7518e7125efbf0172f594b8568b0623e7c","first_seen":"2023-04-09T01:10:46Z","last_seen":"2026-07-19T03:06:35.201147Z","times_seen":200,"resource_available":false,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":494,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/en-US.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.561Z","timestamp":1784394601561,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/en-US.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-65aa\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":26026,"size_decoded":4101,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text, with very long lines (24110), with no line terminators","md5":"8428a16a6e010d36b8795a210c653574","sha1":"8ec396a82202672df94d87f1acb03a14328bdd6c","sha256":"509c9d619a243a90fb9dba381571ba57af8fdbeee50d9c73ee928df8c4b1fb1c","sha512":"c78ca1b3d117877810b528c988dfaabaf79730e4cd1bddaac8ede14c5439fb5cd23ffadd59e6f7512b4f6cce2330332c8dbb9cc31d00dab4c8fab78721c1a303","ssdeep":"768:cHonDDLD67hD7hY/BkwOY4jE4jbD2UV1ZK2UV1Zv2UV1ZPY7P4:cInDDLDqpY/BkwOY4jE4jbD5ZK5Zv5Zp","tlshash":"24c2769904e7787103bf11efdcc96a9ded4d67b4e113de2362222934c94be4eba0e509","first_seen":"2023-03-07T15:25:41Z","last_seen":"2026-07-19T03:06:35.229038Z","times_seen":13,"resource_available":true,"data":null}},"time_used":423,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-identity-login-page.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.571Z","timestamp":1784394601571,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-identity-login-page.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-31594\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":202132,"size_decoded":50646,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (46223)","md5":"576f76165a1091e08549d18659c45ed0","sha1":"c7bb3c08bb7a8d6fc2158c35be2add5dd4cbe872","sha256":"a789228c2176f8fa139b78318865406aabc5b4d9757d7d2b88ed2dacabd8b424","sha512":"136fec081a0a0d582816c4c0ecbe727bb9808295ff21fe640c34cd8f1470f2c6a734a883d5e9799d41e497b6c669cbf7ea845bf1138b1da47118ce3bf457d223","ssdeep":"6144:VfH0hNcB9zfIA5yft17aoKgs98qtLrqor7NQ8K9ErEj1:2+5aMi+ro","tlshash":"78141ac936a0f86513a750a2903f110ff27a6a7d94ace490e361cce97df558e4227f39","first_seen":"2026-07-18T00:23:58.508947Z","last_seen":"2026-07-19T03:06:35.211399Z","times_seen":8,"resource_available":true,"data":null}},"time_used":682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":682,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/gtkp_aa.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.579Z","timestamp":1784394601579,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/gtkp_aa.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-6290\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":25232,"size_decoded":7686,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (25232), with no line terminators","md5":"84cbd37a5ec4f68cd169659b97b945f6","sha1":"96096984f131fa2b9a7766f2023f74849f3adbda","sha256":"fbbaa7c67eefc2511be2ebd4fff4ecad779031c67acf108499ede1f1c2f3e5b5","sha512":"1948fdf107d69dac22ef3aba3873f77429b5e9c0249959d142cf7c5a1364e55e8150ae74e23b1040fb76bda8b5d2bf17bf802a6a838903d7112425bb04316237","ssdeep":"768:8GqGMzC6XfoMCmZYNLGFhaEzQBhgvBJgdZxJgrqvlqe1xXN:8GDMzCOZCmZYNLGtyZxJgrqvzxXN","tlshash":"8bb2f79a71613012828b21b514bf120e713b5aa50d8ea4f8f187c9e67df4e59522ffbc","first_seen":"2023-03-07T12:58:08Z","last_seen":"2026-07-19T03:06:35.197596Z","times_seen":60,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../fonts/Roboto-Medium.woff","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.336Z","timestamp":1784394602336,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":274108,"size_decoded":274294,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Regular.woff","fqdn":"www.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.688Z","timestamp":1784394602688,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Regular.woff HTTP/1.1\r\nHost: www.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 76792\r\nlast-modified: Sat, 26 Oct 1985 08:15:00 GMT\r\netag: \"1dc09d84-12bf8\"\r\ntiming-allow-origin: *\r\ncache-control: max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccept-ranges: bytes\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\nakamai-request-bc: [a=23.36.77.197,b=214285089,c=g,n=NO__OSLO,o=20940]\r\nvary: Origin, Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":76792,"size_decoded":77248,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 76792, version 0.0","md5":"6824f89aed1f9cea50aeae0f94e590e4","sha1":"b110bcca0524f8b001826673291c6201fbebd161","sha256":"7ef974010abfe71fb92dc3f53e3948e1e544cf6821bf9802ea0bf35fa8fe5af6","sha512":"1a88207489af7406dee0b8d456d024a483a63340cb99f0f854984705cb4dfb5cc3fb476724500d75af9de8d1ac646481c59e1399a1222a1a06a454451b6e7f11","ssdeep":"1536:dMtqXFH9eSaYtUaXrvQ+bAbYaYgCCZ9+KMC1FE:SqXFDaYtB0jZ3DZ81wS","tlshash":"927302b85e72424dc5d7787b8c10c8e4ee1571e52817b0cf946e7e79fa82f24b2825a3","first_seen":"2023-05-07T17:21:29Z","last_seen":"2026-07-19T03:06:35.208942Z","times_seen":359,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":17,"receive":1,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"icm.aexp-static.com/content/dam/chat/sl/us/js/chatSupplier.js","fqdn":"icm.aexp-static.com","domain":"aexp-static.com","tld":"com"},"ip":{"addr":"96.6.17.190","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.691Z","timestamp":1784394602691,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Sep 2025 00:00:00 GMT","end":"Wed, 23 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6F:E1:06:90:3D:67:77:FD:37:70:A0:A4:4A:DD:30:3C:BF:A8:24:22","sha256":"40:29:EF:0A:AA:F5:D5:7F:37:FD:74:1F:80:3F:28:42:35:ED:A0:2D:8C:1B:A3:47:CC:17:BC:57:8C:A0:4D:17"}}},"request":{"raw":"GET /content/dam/chat/sl/us/js/chatSupplier.js HTTP/1.1\r\nHost: icm.aexp-static.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://americanxpresses.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\naccess-control-allow-headers: Content-Type\r\ncontent-security-policy: default-src 'self'\r\ncontent-length: 256\r\ncontent-type: text/html;charset=utf-8\r\ncache-control: public, must-revalidate, max-age=14400\r\ndate: Sat, 18 Jul 2026 17:10:03 GMT\r\nvary: Accept-Encoding\r\nakamai-request-bc: [a=23.63.30.63,b=410943387,c=g,n=US_TX_DALLAS,o=20940],[c=c,n=US_TX_DALLAS,o=20940],[a=21,c=o], [a=23.36.77.197,b=214285094,c=g,n=NO__OSLO,o=20940],[c=c,n=SE_AB_STOCKHOLM,o=20940],[c=c,n=US_TX_DALLAS,o=20940],[c=c,n=US_TX_DALLAS,o=20940],[a=1,c=o]\r\nset-cookie: ak_bmsc=3A0BC7401F8058DC4CD87C29346C7553~000000000000000000000000000000~YAAQxU0kF3Qtk16fAQAAcdo0dgDg+yNuLKyV1wFwRWg+BSiDOC95VurOGbDkw6Qd6A4wzGzV5p2LVsXyt27Un/U/amFV8T3gfUcJfkHvmztoeS6uoH0jHT8kI3Jw31F1B3hm6Rw/WhoqeDXDwksAPos7oPWlvFZs354T7vyErM9+MK1LYaKqMJ2EhBFO4XYsYVLeQFMnV17iy33DoA6fIl+PuTgRy1XU9y/I/o1fN450fY0gwCer8gWT8tPNspm1ZnqqqtTCcgPTtsINdlR/F/WH8HWijcUw+1QFFLsTQ+i8WH3SKNRzG/uypFZJIxlShTNofk2iORDJx6nFxtNUWX12lP6xgOD8kSWAqlTAmBUaY5vx7zYbQLhbCCmaK24Rqk9uCD4HGZ6kfo0A4BgulQM=; Domain=.aexp-static.com; Path=/; Expires=Sat, 18 Jul 2026 19:10:02 GMT; Max-Age=7199; SameSite=None; Secure; HttpOnly\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Akamai","description":"Akamai is global content delivery network (CDN) services provider for media and software delivery, and cloud security solutions.","website":"https://akamai.com","common_platform_enumeration":"","icon":"Akamai.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Akamai Bot Manager","description":"Akamai Bot Manager detect bots using device fingerprinting bot signatures.","website":"https://www.akamai.com/us/en/products/security/bot-manager.jsp","common_platform_enumeration":"","icon":"Akamai.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T03:20:33.261029Z","times_seen":17355136,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"origin-pqgemapp.americanexpress.com/content/dam/chat/sl/static/chatLauncher.js?70","fqdn":"origin-pqgemapp.americanexpress.com","domain":"americanexpress.com","tld":"com"},"ip":{"addr":"12.29.101.63","port":443,"asn":6307,"as":"AMERICAN-EXPRESS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.704Z","timestamp":1784394602704,"http_version":"HTTP/1.1","security_state":"","security_info":null,"request":{"raw":"GET /content/dam/chat/sl/static/chatLauncher.js?70 HTTP/1.1\r\nHost: origin-pqgemapp.americanexpress.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 502 Bad Gateway\r\nDate: Sat, 18 Jul 2026 17:10:03 GMT\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains;\r\nContent-Length: 232\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T03:20:33.261029Z","times_seen":17355136,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/le-mtagconfig.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.594Z","timestamp":1784394601594,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/le-mtagconfig.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-6dc\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1756,"size_decoded":877,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1756), with no line terminators","md5":"375b2eabe48c53d2ddfb48ccedcdabd6","sha1":"324cda82e51a0eab0ac41d8361832c686358bbaf","sha256":"0119d3c9c9d6499e8535e8dfff1fb8d2f891fb1434280b3a185dc82f1a944e32","sha512":"003e9f9ad32bef0db9a882a2f9281d247b302aa0b9c8e87fbdf5c02fb7d84bf6050934f48b79a4b83bdd5f0020a1c52e737e136a8095f8340c4ae6efc77f12bf","ssdeep":"","tlshash":"0031ae2d7010b635445620694bbfb30bec77609a58014e643528d8fddb2ce8b19768ff","first_seen":"2026-07-18T00:23:58.506007Z","last_seen":"2026-07-19T03:06:35.231571Z","times_seen":8,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.335Z","timestamp":1784394602335,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":274108,"size_decoded":274294,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../iconfont/dls-icons.woff?v=5.10.1","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.339Z","timestamp":1784394602339,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":274108,"size_decoded":274294,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"iwmap.americanexpress.com/monitoring/info?preflight","fqdn":"iwmap.americanexpress.com","domain":"americanexpress.com","tld":"com"},"ip":{"addr":"139.71.113.137","port":443,"asn":6307,"as":"AMERICAN-EXPRESS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:03.621Z","timestamp":1784394603621,"http_version":"HTTP/1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"iwmapapi1.americanexpress.com","organization":""},"issuer":{"commonName":"DigiCert EV RSA CA G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 27 Jun 2026 00:00:00 GMT","end":"Thu, 12 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6C:21:12:63:93:EF:9A:57:26:7A:77:93:E5:7C:B5:31:E0:CB:F0:90","sha256":"ED:BA:6E:B2:12:18:24:0D:75:D6:60:8B:E6:E8:64:9D:46:E3:82:33:05:32:B5:E5:D9:DA:CB:D7:13:D7:85:11"}}},"request":{"raw":"GET /monitoring/info?preflight HTTP/1.1\r\nHost: iwmap.americanexpress.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://americanxpresses.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.0 404 Not Found\r\nServer: BigIP\r\nConnection: Keep-Alive\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"F5 BigIP","description":"F5's BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions.","website":"https://www.f5.com/products/big-ip-services","common_platform_enumeration":"cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:*","icon":"F5.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":84,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T03:20:33.261029Z","times_seen":17355136,"resource_available":true,"data":null}},"time_used":173,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/axp-voice-of-customer.client.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.537Z","timestamp":1784394601537,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/axp-voice-of-customer.client.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: W/\"6918b381-188dc\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":100572,"size_decoded":30406,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (31090)","md5":"f2072648394113eef50afaafea0621f3","sha1":"68889599b1c8be0bc44a22d0ecbccecbc66189b2","sha256":"85bbd9fec0b60035ccefc6088a04660609ee27f12af3efcb2f2d650354b4b6d6","sha512":"5b97fea7048e6390f3178feef3e0f8ae53b6f4c20f16da5afc49d8a9f8dc055bfb8ef8ca0a94b156988c434842ea1072aba38529f1519668cb8046abe0b71495","ssdeep":"3072:8wEkmZlm1zfXIA5Wft7229jaoK2asgOxH7b:BEkulm1zfIA5Wft1jaoKzsgS7b","tlshash":"74a31bc57ba0f8a217a790b1a03f100bf2f7982ea49de491f255c5d4adba40e415bf7c","first_seen":"2023-03-07T12:58:08Z","last_seen":"2026-07-19T03:06:35.22298Z","times_seen":15,"resource_available":true,"data":null}},"time_used":516,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":516,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/1.1b6f10a72211dd7774da.chunk.js.download","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.552Z","timestamp":1784394601552,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/1.1b6f10a72211dd7774da.chunk.js.download HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 15 Nov 2025 17:08:18 GMT\r\netag: W/\"6918b382-6958\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26968,"size_decoded":6148,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (26004)","md5":"6c6d45c623756e2474fa3c87df57f83e","sha1":"7cec6f5a7e3679bbcb97021d24772bcf89bcbcd2","sha256":"1030e9d4c753a212fbeb3009666cb3bffe6a2624441f9762156c4cad06dee4d7","sha512":"dff187518751563acd399312ad17dc57fe21ce980bcbcb3441be8dd042ece931276fb293b80a9588bc58426280cf7dc17727392cfd4ca6cddabdb0fccfe0aefc","ssdeep":"768:HJUBrTKABAYAcyGIA49DAy8DiAhAPEqsLV9Psasvg4GLa9utvTBapIBvT69aP88:paTKABAYAcyGIAgUiAhAPORZsvaa8tvz","tlshash":"3bc29697b686ba5400cb3062a47f57c765362039414192b6dc06c4e8a6ffcf4d26bfeb","first_seen":"2026-07-18T00:23:58.450696Z","last_seen":"2026-07-19T03:06:35.232098Z","times_seen":8,"resource_available":true,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/signin_files/20-AMX-0046_Covid19Support-AmexBanner_300x250_m01_46.jpg","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:01.602Z","timestamp":1784394601602,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/signin_files/20-AMX-0046_Covid19Support-AmexBanner_300x250_m01_46.jpg HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:01 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 10058\r\nlast-modified: Sat, 15 Nov 2025 17:08:17 GMT\r\netag: \"6918b381-274a\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":10058,"size_decoded":10309,"mime_type":"image/jpeg","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x250, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0980e5f96d2460d54c0d9eb6dad19c2d","sha1":"f1c9bd962bd45d8f26a8a9ea2ea5ec061df70e46","sha256":"8520700a3b4774837d41056932e79832e1f83f318e967acfd3da089110a5c018","sha512":"7aa8d10097a901d96bc4cfd7ea8628b5ab19ef09120bc4984475e3a5cdf18dcaaa6dd5cefbd2574f7efb346c1aa544a7d17083e6edee76e8ab567a9e0586881d","ssdeep":"192:PZpvwNCpwQmRHTn5xAzsJge20JgVxRqDV1TZ7yOgSMenZy3f2VHagPprZpF:PZ9iswVzn3E+gVxQznnZy3f2xaUt/","tlshash":"e622d1d29c53b1ebe1b64c4a5202eb84751df94900acb9abc0d6684975c3f77d091f94","first_seen":"2026-07-18T00:23:58.447678Z","last_seen":"2026-07-19T03:06:35.255894Z","times_seen":8,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/one/statics/axp-dls/5.10.1/package/dist/css/../fonts/Roboto-Regular.ttf","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:02.696Z","timestamp":1784394602696,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":274108,"size_decoded":44811,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"americanxpresses.com/web/login.php?web/cox/SignOn#/cdaas/axp-app/modules/axp-identity-root/1.26.1/images/icon-192.png","fqdn":"americanxpresses.com","domain":"americanxpresses.com","tld":"com"},"ip":{"addr":"92.205.27.200","port":443,"asn":21499,"as":"Host Europe GmbH","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanxpresses.com/web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=UVUHT1OZZDr4Au8dcwG3nlQFU1NIpmwjDMUiLhZbz1CPhGWf2zHUbEOYKXHFc41jw4l22aNLpf7bTsp5","date":"2026-07-18T17:10:03.351Z","timestamp":1784394603351,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanxpresses.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:39:06 GMT","end":"Wed, 14 Oct 2026 21:39:05 GMT"},"fingerprint":{"sha1":"5A:BB:E3:14:41:1C:0F:BA:09:3A:84:84:9C:48:2B:96:8C:4B:04:F4","sha256":"D6:E2:3D:E5:35:39:68:4A:36:D6:EB:5D:DE:D6:82:CF:57:D7:2C:9C:96:46:B2:08:6F:A6:45:24:6C:27:DD:0F"}}},"request":{"raw":"GET /web/login.php?web/cox/SignOn HTTP/1.1\r\nHost: americanxpresses.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://americanxpresses.com/web/login.php?web/cox/SignOn\r\nCookie: AMCV_5C36123F5245AF470A490D45%40AdobeOrg=1585540135%7CMCMID%7C33481947444931093357692668994922421927%7CMCAID%7CNONE%7CMCOPTOUT-1784401803s%7CNONE%7CvVersion%7C4.4.0; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:10:03 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.4.23, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":274108,"size_decoded":44811,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47888)","md5":"3aa287c8f80ae755b789c7390a18203b","sha1":"d02b0b4d73bf9d715b9846d0d7432ef948a3d532","sha256":"9daf01c1c76f1c843b55e10204fd97488f54efbad57038b9a2039c16152abd0e","sha512":"3be8746187f42035bd2d292edc0e3ad6c6e3006e3878e46eb751126500c04a6969c2b3702eedfbefd8244f501bb263b52b0be964590e16d2cf06d17c37e36039","ssdeep":"3072:2whaBAUC2g73GZgltSybITWv+S3OgJqpWX:2whaBAP2gLb6VKtbqYX","tlshash":"af44ffe993f5666f4279398ef942390aef9901ae441e1db3f70ee58e1dc264783f2104","first_seen":"2026-07-18T00:23:58.448595Z","last_seen":"2026-07-19T03:06:35.194246Z","times_seen":8,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"americanxpresses.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"americanxpresses.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - American Express","verdict":"phishing","severity":"medium","comment":"Associated with American Express phishing","tags":["american_express","financial","phishing"],"meta":null}]}}]}