thunderous-sorbet-780abf[.]netlify[.]app

Analysis indicates that thunderous-sorbet-780abf.netlify.app is currently offline but was previously serving a page titled “Naver Sign in”. The site explicitly impersonates Naver and is classified as a credential‑phishing campaign. The domain was registered on May 09 2018 through Netlify and uses the Netlify hosting platform, which is reflected in the detected technologies (Netlify, HSTS). DNS resolution points to 98.84.224.111, an address owned by Amazon.com, Inc. (AS14618) and located in the United States.

The SSL certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc., confirming that the site employed a valid TLS certificate despite its malicious purpose. Security telemetry shows that 19 of 93 VirusTotal scanners flagged the domain, and it appears on at least one public blocklist, with PhishDestroy confirming the site as blocked. The authoritative name servers are dns1.p01.nsone.net through dns4.p01.nsone.net. An HTTP request returns a 404 status, indicating that the content is no longer reachable.

No additional evidence such as page screenshots or JavaScript payloads is available because the site is taken offline. Defenders should add thunderous-sorbet-780abf.netlify.app and its resolving IP 98.84.224.111 to domain and IP blocklists, enforce URL filtering for the “Naver Sign in” title pattern, and monitor Netlify‑hosted subdomains for similar impersonation attempts. Continuous observation of the associated name servers and the AS14618 prefix is advised, as threat actors often reuse the same infrastructure for future campaigns. The combination of verified SSL, Netlify hosting, and partial VirusTotal detection underscores the need for proactive mitigation despite the current offline status.