Paul Security Weekly #617 on DomainTools Iris

### Executive Summary This report documents an investigation of a phishing email impersonating American Express, where an attached HTML file and obfuscated JavaScript chained to multiple attacker domains used a fraudulent login page to harvest credentials; the analyst enumerated related domains and shared IP infrastructure with DomainTools Iris and VirusTotal and advised blocking the domains and IPs.