fantastic-invention-alpha[.]vercel[.]app

The domain fantastic-invention-alpha.vercel.app is identified as a credential theft operation impersonating Naver, a South Korean online platform. Analysis confirms the site was actively harvesting user login credentials under the guise of a legitimate Naver sign-in portal. The page title "Naver Sign in" and its infrastructure align with known tactics used in targeted credential theft campaigns. As of the latest assessment, the domain has been taken offline, though its prior activity remains a documented threat. Infrastructure analysis reveals the domain was created on February 21, 2026, and registered through Tucows Domains Inc. It resolved to the IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate was issued by Google Trust Services (WR1). Security vendors flagged the domain as malicious, with 17 of 95 VirusTotal engines detecting it as a phishing threat. Google Safe Browsing also classified the domain as phishing, and it appeared on at least one security blocklist. The combination of brand impersonation, recent creation date, and low detection thresholds among vendors underscores its high-risk classification. The domain is currently offline, reducing immediate exposure risk. However, users who may have interacted with the site should assume their credentials were compromised. Affected individuals are advised to reset passwords for Naver and any accounts where identical credentials were reused. Organizations should monitor for unauthorized access attempts linked to this domain and update blocklists to include the IP address 64.29.17.3. Security teams are encouraged to review logs for connections to fantastic-invention-alpha.vercel.app or its resolved IP to identify potential breaches. Proactive measures, such as multi-factor authentication and credential hygiene training, are recommended to mitigate similar threats.