lucent-tapioca-9a32b5[.]netlify[.]app

The domain lucent-tapioca-9a32b5.netlify.app is currently active and has been identified as a brand impersonation phishing site targeting Facebook. Despite showing a page title of "네이버 : 로그인" in Korean, the threat analysis confirms the domain is designed to steal login credentials for Facebook. This domain is flagged as phishing by Google Safe Browsing and is listed on one security blocklist, with 21 out of 95 VirusTotal vendors marking it as malicious. The domain resolves to IP address 54.253.94.210 and is registered through Netlify, with an SSL certificate issued by DigiCert Inc under their DigiCert Global G2 TLS RSA SHA256 2020 CA1. The high risk level is underscored by its active status and the sophistication of the fake login page.

Given that this phishing domain impersonates Facebook, a widely used platform, the threat to users is significant. The domain's registration through Netlify, a legitimate hosting service, makes it harder for casual users to identify as malicious. The SSL certificate adds a false sense of security, as users often associate HTTPS with legitimacy. The discrepancy between the page title (Korean for "Naver: Login") and the actual target (Facebook) indicates a possible multi-brand phishing attempt or a poorly configured attack. The high number of VirusTotal detections (21/95) and the Google Safe Browsing flag provide strong evidence of the domain's malicious intent.

Users are strongly advised to avoid visiting this domain entirely. If you have already entered any credentials on this site, change your Facebook password immediately and enable two-factor authentication. PhishDestroy recommends verifying all login URLs before entering sensitive information, especially for brands like Facebook. Report this domain to Netlify for abuse and to Google Safe Browsing to protect other users. Stay vigilant against similar phishing attempts that use legitimate hosting services and SSL certificates to appear trustworthy.