psychic-bassoon-delta[.]vercel[.]app

This domain, psychic-bassoon-delta.vercel.app, is identified as a high-risk credential phishing site specifically targeting Naver account holders. The page title, 'Naver Sign in,' directly mimics the legitimate login portal of the South Korean web platform, indicating an intent to harvest user credentials through deceptive authentication interfaces. No explicit drainer kit signatures were observed in initial scans, though the infrastructure aligns with common phishing-as-a-service deployments on cloud hosting platforms. The domain exhibits no overt malware distribution, focusing instead on credential interception and potential follow-on account takeover operations. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered through Vercel Inc. on February 27, 2026, with an SSL certificate issued by Google Trust Services (WR1). It resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Google Safe Browsing has flagged this domain as phishing, while VirusTotal reports 21 out of 95 security vendors detecting it as malicious. The domain appears on at least one security blocklist, further validating its classification as a phishing threat. The domain has been taken offline, significantly reducing immediate risk to end users. However, the underlying infrastructure remains potentially active, and similar domains may emerge using the same hosting provider or registration patterns. Users who accessed the site prior to takedown should immediately reset their Naver credentials and enable multi-factor authentication. Organizations should monitor for credential reuse attempts and update blocklists to include related indicators of compromise. The creation date discrepancy (2026) suggests potential domain squatting or misconfigured registration data, warranting continued vigilance for related phishing campaigns.