solid-fishstick-pearl[.]vercel[.]app

This domain, solid-fishstick-pearl.vercel.app, is flagged for elevated-risk brand impersonation targeting Naver users. The specific threat type involves credential theft, where attackers mimic the legitimate Naver sign-in portal to harvest user login credentials. Analysis indicates this infrastructure was designed to deceive users into entering sensitive account details, which could lead to unauthorized access or further exploitation of compromised accounts.

Infrastructure analysis reveals the domain resolved to IP address 216.198.79.67, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The domain was registered through Vercel Inc. and utilized an SSL certificate issued by Google Trust Services (WR1). At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious. The page title, 'Naver Sign in,' directly corroborates the brand impersonation targeting Naver. The domain appears on two security blocklists and has since been taken offline, though prior exposure remains a concern.

To mitigate risks associated with this type of credential theft, affected organizations should immediately invalidate any sessions tied to the impersonated domain and enforce multi-factor authentication (MFA) for all user accounts. Users who may have interacted with the domain should reset their credentials via the legitimate Naver portal and monitor accounts for unauthorized activity. Network-level protections, such as DNS filtering or endpoint detection rules, should be updated to block the domain and associated IP address. Security teams are advised to review logs for connections to 216.198.79.67 or requests to solid-fishstick-pearl.vercel.app to identify potential compromises.