nid-navar[.]protanec[.]com

The domain nid-navar.protanec.com was observed hosting a credential‑stealing page that presented the Korean title “네이버 : 로그인”. The site resolved to the IPv4 address 172.245.241.100, which is announced by AS36352 (HostPapa) and geolocated to Ireland. Registration records show the domain was created on 21 February 2026 through DropCatch.com 1018 LLC, and the authoritative name servers are ns1.dropcatch.com and ns2.dropcatch.com. The certificate presented is identified as R13, and the site is currently taken offline. Threat intelligence aggregators have flagged the domain: one security blocklist includes it, PhishDestroy has listed it as malicious, and Gridinsoft assigns a trust score of zero out of one hundred.

VirusTotal analysis returned detections from 13 of 93 scanned engines, confirming malicious intent. No public Safe Browsing or Open Threat Exchange entries were observed for the domain at the time of analysis. The combination of a brand‑specific page title, low trust score, multiple vendor detections, and hosting on a shared provider indicates a classic credential‑phishing operation targeting users of the Korean service referenced in the title. At present no additional artifacts such as malware payloads or command‑and‑control infrastructure have been disclosed.

The offline status suggests the operators have withdrawn the site, but the underlying infrastructure remains reusable. Defenders should immediately add nid-navar.protanec.com and its resolved IP 172.245.241.100 to blocklists, monitor DNS queries for the domain and its DropCatch name servers, and consider extending protection to other domains registered by the same registrar. Security teams should also review logs for any authentication attempts to the target brand around the domain’s active window (February–July 2026) and enforce multi‑factor authentication for affected accounts. Continuous re‑scanning of the IP address is advised in case the host is re‑used for future campaigns.