692e6414c3ffb2b12624b6fd--thunderous-sorbet-780abf[.]netlify[.]app

This domain presents an elevated risk as a brand impersonation threat specifically targeting Naver users through credential theft. The site was designed to mimic the Naver sign-in page, tricking visitors into entering their login credentials. Though currently taken offline, the domain posed a serious risk to anyone who encountered it while active.

Security analysis reveals that 19 out of 95 antivirus engines on VirusTotal flagged this domain as malicious. The site was hosted via Netlify and resolved to IP address 2a05:d014:58f:6200::258, with an SSL certificate issued by DigiCert Inc. It appeared on two security blocklists, indicating known malicious activity. The combination of these indicators confirms the domain's purpose as a credential harvesting tool.

To protect against such threats, users should always verify the URL before entering sensitive information, enable two-factor authentication on Naver accounts, and use a password manager to avoid reusing credentials. If any credentials were entered on this site, they should be changed immediately and accounts monitored for unauthorized access.