Malcovery Security saw an American Express phishing campaign over the weekend. The subject line of the email was always “Fraud Alert: Irregular Card Activity” The highlighted link that claims it will take you to https://www.americanexpress.com/ actually goes to one of 419 URLs on one of 57 compromised webservers. The list of servers is:.0067959.com.com,.02fbd07.com and.02fBD07.”]
Source: http://garwarner.blogspot.com/2013/10/a-prominent-american-express-phish.html