ynabioueconus-meriescs-experinces-t[.]vercel[.]app

This domain, ynabioueconus-meriescs-experinces-t.vercel.app, operates as a credential harvesting site designed to mimic Naver’s authentication portal. Analysis indicates the site presents a fraudulent "Naver Sign in" page to deceive users into submitting login credentials, which are then captured by threat actors. The campaign specifically targets Naver account holders, potentially leading to unauthorized account access, financial fraud, or further phishing attacks via compromised contacts. Infrastructure analysis reveals the domain is hosted on Vercel Inc.’s platform and resolves to the IP address 64.29.17.3, located within Amazon’s AS16509 network in the United States. The site remains active and is flagged by 22 out of 95 security vendors on VirusTotal, including detections for phishing by Google Safe Browsing. It appears on two security blocklists and is explicitly blocked by at least two threat intelligence feeds. The SSL certificate is issued by Google Trust Services under the identifier WR1, a common pattern observed in low-effort phishing deployments. If a user has visited this domain or entered credentials, immediate action is required. First, change the Naver account password using a secure device and enable multi-factor authentication if not already active. Review recent account activity for unauthorized logins or transactions. Monitor linked financial accounts for suspicious charges. Clear browser cache and cookies to remove any persistent tracking elements. Report the incident to Naver’s security team and consider notifying local cybersecurity authorities if sensitive data was exposed. Avoid reusing the compromised password across other platforms.