laughing-octo-succotash-eta[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat specifically designed for credential theft targeting Naver, a major South Korean platform. Analysis indicates the infrastructure was constructed to deceive users into submitting login credentials through a fraudulent Naver sign-in interface, as evidenced by the page title 'Naver Sign in' and confirmed impersonation of the Naver brand. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain laughing-octo-succotash-eta.vercel.app appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by Google Safe Browsing as phishing. It resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was registered through Vercel Inc. on January 28, 2020, and uses an SSL certificate issued by Google Trust Services (WR1). VirusTotal detection shows 19 out of 95 security vendors flagging this domain as malicious, with a clear focus on credential harvesting. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address (216.198.79.195) at network perimeter devices. Organizations should implement additional authentication factors for Naver accounts and conduct password resets for any users who may have interacted with this domain. Security teams should monitor for credential reuse across other platforms, as stolen Naver credentials are frequently tested against banking, email, and social media services. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for services handling sensitive personal or financial data.