{"id":11060,"date":"2022-04-12T05:49:49","date_gmt":"2022-04-12T05:49:49","guid":{"rendered":"https:\/\/myonlinesecurity.co.uk\/?p=11060"},"modified":"2023-03-31T07:20:10","modified_gmt":"2023-03-31T07:20:10","slug":"american-express-account-alert-personal-safe-key-psk-phishing","status":"publish","type":"page","link":"https:\/\/myonlinesecurity.co.uk\/american-express-account-alert-personal-safe-key-psk-phishing\/","title":{"rendered":"American Express Account Alert: Personal Safe Key (PSK) \u2013 Phishing"},"content":{"rendered":"<p>We are seeing a mass run of phishing emails spoofing American Express saying Please create your Personal Security Key. There are 3 sites so far discovered that attempt to perform this phishing attack<\/p>\n<ul>\n<li>http:\/\/americanexpressnew2016.com\/login<\/li>\n<li>http:\/\/americanexpressglobal.com\/login<\/li>\n<li>http:\/\/axpoglobalverify.com\/login<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Currently all 3 sites fail to resolve from a UK IP address. They were all registered yesterday 8 March 2021 via Todaynic.com using Chinese details which I assume are false. The name servers associated with the domains are DNS1.NEWSITEDNS2.RU and DNS2.NEWSITEDNS2.RU<\/p>\n<p>Edit: after a bit of digging around, it appears that the NEWSITEDNS2.RU has previously been used for Amex and other bank phishing attacks. It is suggested that you block their IP numbers to prevent further and future problems<\/p>\n<ul>\n<li>155.94.169.106 VirusTotal<\/li>\n<li>104.168.62.233 VirusTotal<\/li>\n<li>50.2.26.16 VirusTotal<\/li>\n<li>148.163.173.227<\/li>\n<li>192.210.203.49<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Either the DNS has not propagated yet worldwide or the DNS service has pulled the domains. My gut feeling is that the bots have sent the emails too early before the sites were live. The date &amp; time on the emails say Wed 30\/09\/2021 13:32 . I received about 50 copies of these between 03.20 and 03.30 UTC.<\/p>\n<p>Be aware and watch out for when these do go live, probably later today<\/p>\n<p>Email looks like:<\/p>\n<p><strong>From:<\/strong> American Express Customer Service &lt;AmericanExpress@welcome.aexp.com&gt;<\/p>\n<p><strong>Date<\/strong>: Wed 30\/09\/2021 13:32<\/p>\n<p><strong>Subject<\/strong>: Account Alert: Personal Safe Key (PSK)<\/p>\n<h3><strong>Body Content<\/strong>:<\/h3>\n<blockquote>\n<table>\n<tbody>\n<tr>\n<td width=\"600\">&nbsp;<\/p>\n<h3>American Express Personal Safe Key (PSK)<\/h3>\n<p><em>Please create your Personal Security Key. Personal Safe Key (PSK) is one of several authentication measures we utilize to ensure we are conducting business with you, and only you, when you contact us for assistance.<\/em><\/p>\n<p><em>American Express uses 128-bit Secure Sockets Layer (SSL) technology. This means that when you are on our secured website the data transferred between American Express and you is encrypted and cannot be viewed by any other party. The security of your personal information is of the utmost importance to American Express, please access<\/em><\/p>\n<p><em><u>htt<\/u><u>ps:\/\/americanexpress.com<\/u>\u00a0to create your PSK (Personal Safe Key).<\/em><\/p>\n<p><em>Note: You will be redirected to a secure encrypted website.<\/em><\/p>\n<p><em>The contained message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Sincerely, American Express Customer Service.<\/em><\/p>\n<p>&nbsp;<\/p>\n<p><em>Kind regards, Dave Barry<\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>We are seeing a mass run of phishing emails spoofing American Express saying Please create your Personal Security Key. There are 3 sites so far discovered that attempt to perform this phishing attack http:\/\/americanexpressnew2016.com\/login http:\/\/americanexpressglobal.com\/login http:\/\/axpoglobalverify.com\/login &nbsp; Currently all 3 sites fail to resolve from a UK IP address. They were all registered yesterday 8&#8230;<\/p>\n","protected":false},"author":8,"featured_media":13401,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"default","_kad_post_title":"default","_kad_post_layout":"default","_kad_post_sidebar_id":"","_kad_post_content_style":"default","_kad_post_vertical_padding":"default","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"taxonomy_info":[],"featured_image_src_large":["https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/03\/phishing.jpg",1000,630,false],"author_info":{"display_name":"Darrel Heers","author_link":"https:\/\/myonlinesecurity.co.uk\/author\/darrel-heers\/"},"comment_info":0,"_links":{"self":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages\/11060"}],"collection":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/comments?post=11060"}],"version-history":[{"count":1,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages\/11060\/revisions"}],"predecessor-version":[{"id":28171,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages\/11060\/revisions\/28171"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/media\/13401"}],"wp:attachment":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/media?parent=11060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}