eclectic-alpaca-4b5116[.]netlify[.]app

The domain eclectic-alpaca-4b5116.netlify.app is flagged as a brand impersonation threat targeting the Naver brand. This domain was registered through Netlify and was designed to deceive users into believing they were interacting with a legitimate Naver service.

Technical indicators include a VirusTotal score of 19/95, indicating that 19 out of 95 security vendors have flagged this domain as malicious. The domain is registered through Netlify and resolves to the IP address 63.176.8.218, which is located in Germany (DE) and is part of the Amazon.com, Inc. network (AS16509). The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate. Google Safe Browsing has also flagged this domain as a phishing site, and it appears on 2 known security blocklists, including PhishDestroy and PhishingDB. The domain's page title, 'Naver Sign in,' further supports the impersonation of the Naver brand.

The domain is currently offline, which suggests that it has been taken down as part of mitigation efforts. Despite this, the threat posed by this domain remains high due to the potential for it to be reactivated or for similar domains to be registered by the same threat actors. Security teams are advised to monitor for any related domains and to ensure that users are educated about the risks of phishing attacks targeting Naver. The remaining risk includes the possibility of the domain being reused or the threat actors deploying new domains with similar characteristics.