execpts-nxieffulgent-cranachan-tansbm[.]netlify[.]app

Analysis of execpts-nxieffulgent-cranachan-tansbm.netlify.app, observed on July 24 2026, shows the site is currently offline, returning HTTP 404 for the root URL. The domain is hosted on Netlify infrastructure, evident from the technology fingerprint Netlify and the presence of HTTP Strict Transport Security (HSTS). DNS resolution points to 98.84.224.111, an address owned by Amazon.com, Inc. (AS14618) and located in the United States. The authoritative nameservers are dns1.p04.nsone.net and dns2.p04.nsone.net, consistent with Netlify’s default deployment. A DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate secures the site, indicating a valid, publicly trusted SSL chain despite the malicious intent.

Brand‑impersonation activity is confirmed by the page title “네이버 : 로그인”, which translates to “Naver : Login”, and the intelligence explicitly labels the scam as targeting Naver. VirusTotal records show 14 of 95 scanned security vendors flagged the domain, suggesting a moderate consensus among scanners that the content is malicious. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on the PhishDestroy blocklist, reinforcing its reputation as a phishing host. Scamadviser assigns a trust score of 1 / 100, reflecting extreme risk.

The limited public evidence does not reveal the specific payload or credential‑harvesting mechanism, and the site’s offline status prevents direct observation of malicious pages. Consequently, the exact tactics used to lure victims remain uncertain. Defenders should block or sinkhole the domain at network perimeter, update URL filtering and email protection rules to include the full domain, and monitor for future resurrection or similar Netlify‑hosted impersonation attempts. Continuous re‑scanning of the domain after any change in status is advised to capture potential re‑activation.