mellow-pithivier-d0afe1[.]netlify[.]app

The domain mellow-pithivier-d0afe1.netlify.app was observed serving a page titled “Daum 로그인”, indicating an attempt to impersonate Daum’s login portal. The site was hosted on Netlify’s infrastructure; DNS resolution pointed to the IP 63.176.8.218, which belongs to the Amazon.com, Inc. AS16509 network and is geolocated in Germany. The TLS certificate presented is a DigiCert Global G2 RSA SHA‑256 certificate issued in 2020, a generic certificate not tied to the Daum brand and consistent with Netlify’s default provisioning. HTTP requests returned a 404 status, and the domain is currently flagged as offline.

VirusTotal analysis recorded 19 detections out of 95 scanners, confirming malicious classification. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. Registrar information shows the domain was created on 15 April 2023 and was provisioned through Netlify, with nameserver data not disclosed (NS_NOT_FOUND). Technology fingerprints include Netlify hosting and HTTP Strict Transport Security (HSTS) headers.

The combination of brand‑specific page title, use of a reputable hosting provider to obtain a valid SSL certificate, and multiple vendor detections demonstrates a high‑risk brand‑impersonation campaign targeting Daum users. Defensive teams should ensure the domain is added to network and email deny‑list rules, verify that any outbound DNS queries to the Netlify‑owned IP range are inspected, and monitor for similarly structured Netlify subdomains that reference Daum. Continuous threat‑intel feeds should be consulted for new indicators of compromise, and any user‑reported attempts to access this URL should be treated as phishing incidents and escalated according to incident‑response procedures.