eoog[.]keyplusys[.]com

eoog.keyplusys.com has been classified as a high-risk, generic phishing threat. The active status of this domain, combined with its confirmed involvement in phishing activities, poses a significant risk to end users and organizations. The site is designed to deceive visitors, as indicated by its misleading page title referencing a legitimate media outlet, thereby increasing the likelihood of credential harvesting or other forms of data compromise.

Technical analysis reveals multiple indicators of compromise. The domain was registered on July 15, 2020 through Alibaba Cloud Computing (Beijing) Co., Ltd., suggesting access to global infrastructure. The domain resolves to IP address 172.66.47.63. VirusTotal analysis shows that 21 out of 95 security vendors currently flag this domain for malicious or phishing-related activity. Additionally, eoog.keyplusys.com appears on 2 independent security blocklists, further corroborating its malicious reputation. The use of a reputable registrar and continued active status over several years indicate persistence and potential for ongoing threats.

To mitigate the risk associated with this domain, network defenders should immediately block access to eoog.keyplusys.com at both network and endpoint levels. Security teams are advised to update threat intelligence feeds and configure security appliances to recognize and prevent connections to 172.66.47.63. Users should be educated about the risks of interacting with unsolicited links or emails referencing this domain, and incident response teams should monitor for evidence of phishing attempts leveraging this infrastructure. Organizations should also consider deploying email and web filtering policies designed to detect and quarantine inbound threats associated with known phishing campaigns.