692e63c6e33d1db827f89d21--thunderous-sorbet-780abf[.]netlify[.]app

The domain 692e63c6e33d1db827f89d21--thunderous-sorbet-780abf.netlify.app was created on December 02, 2025 and is currently taken offline, returning an HTTP 404 status. The page title resolved to "Naver Sign in," indicating a credential‑phishing intent that directly targets the Naver brand. Infrastructure analysis shows the site was hosted on Netlify, with HSTS enabled, and resolves to the IP address 63.176.8.218, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The SSL certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 issued by DigiCert Inc, confirming a legitimate‑looking TLS layer.

Reputation data is extremely poor: a Scamadviser trust score of 1 out of 100 and appearance on one public security blocklist, specifically PhishDestroy. VirusTotal scans flagged the domain in 21 of 95 security vendors, reinforcing the malicious assessment. The registrar information indicates the domain was provisioned through Netlify’s automated registration service, and no authoritative nameservers were reported (NS_NOT_FOUND). The overall risk is elevated due to the combination of brand impersonation, credential‑phishing classification, reputable TLS deployment used to increase credibility, and multiple vendor detections.

Uncertainties remain around the exact content of the site, as the offline 404 response prevents direct observation of any phishing form or payload. Defenders should block the domain and its resolving IP at perimeter firewalls, update URL filtering and DNS sinkhole lists, and monitor for other Netlify‑hosted domains that present Naver‑related page titles. Continuous threat‑intel feeds should be consulted for any resurgence of this indicator, and any internal credential‑reuse incidents involving Naver accounts should be investigated for potential compromise.