eonmkm[.]com

The domain eonmkm.com was registered on 12 March 2026 through Gname.com Pte. Ltd. and is hosted on an Alibaba Cloud server (ASN 134963) located in China, using the IP address 170.33.128.19. The hosting environment runs Ubuntu with an Nginx web server and a Vue.js front‑end, as observed from the HTTP fingerprint. No TLS certificate was presented, indicating the site was served only over HTTP before being taken offline. The page title returned by the server is “E.ON”, matching the brand name of a major European energy provider, which suggests the domain was intended to impersonate that organization.

Google Safe Browsing classifies the URL as social engineering, and the domain appears on a single security blocklist as well as being blocked by PhishDestroy. VirusTotal analysis shows that six of ninety‑four scanners flagged the domain, confirming the presence of malicious indicators. The domain’s nameserver set (a.share-dns.com, a1.share-dns.com, b.share-dns.net, b1.share-dns.net) is commonly associated with fast‑flux or shared hosting services, which can aid rapid re‑deployment of phishing infrastructure. The current offline status prevents direct inspection of payloads, leaving the exact content and credential‑capture mechanisms unknown.

However, the convergence of a brand‑matching page title, social‑engineering safe‑browsing flag, partial VirusTotal detections, and the use of a Chinese Alibaba Cloud host aligns with typical generic phishing campaigns that target corporate users. Defenders should block eonmkm.com at the DNS and proxy layers, monitor outbound connections to the associated IP range, and update email filtering rules to flag any communications referencing the E.ON brand that originate from unauthenticated sources. Threat intelligence feeds should also be consulted for any emerging indicators that reference the same hosting provider or similar naming patterns, as threat actors often reuse infrastructure across campaigns.