keypmenu[.]info

The domain keypmenu.info is currently flagged as an active phishing portal designed for credential theft, specifically targeting users through fake login interfaces. Analysis indicates this infrastructure is not associated with any legitimate service but instead mimics authentication pages to harvest sensitive account details. The domain remains operational and poses a high risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on May 7, 2026, through Global Domain Group LLC, a registrar frequently observed in malicious campaigns. It resolves to the IP address 172.67.161.57 and holds a Let's Encrypt SSL certificate, which while providing encryption, does not validate legitimacy. Detection metrics show the domain is flagged by 20 of 95 security vendors on VirusTotal, appears in two AlienVault OTX threat intelligence pulses, and is listed on one security blocklist. Additionally, the domain is actively blocked by Maltrail, further confirming its malicious classification. Current status indicates keypmenu.info remains an active threat with no indications of takedown or remediation. Users are strongly advised to avoid interaction with the domain and any associated links. Organizations should implement network-level blocking for the domain and its resolving IP address. Endpoint protection systems should be updated to include this indicator of compromise (IOC) in detection rules. Individuals who may have entered credentials on this portal should immediately reset passwords and enable multi-factor authentication on affected accounts.