flat-harlequin-r5g0efwahr[.]edgeone[.]app

This domain, flat-harlequin-r5g0efw.edgeone.app, is flagged as a generic phishing site targeting users of the Naver platform. Analysis of the page title, "네이버 : 로그인," confirms the impersonation of Naver’s login portal, a tactic commonly used to harvest credentials. No evidence of a crypto drainer kit or secondary payloads was observed, but the site’s design closely mimics legitimate Naver authentication pages, increasing the likelihood of successful deception. The threat type is classified as brand impersonation with credential theft as the primary objective. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 101.33.10.10 and is registered through Tencent EdgeOne. The SSL certificate, issued by DigiCert, Inc. (DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1), was likely leveraged to lend an appearance of legitimacy. VirusTotal detection metrics show 20 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) hits were recorded prior to takedown. The exact creation date of the domain remains unconfirmed, but its ephemeral nature aligns with typical phishing campaign lifecycles. The domain has been taken offline, likely in response to automated or manual takedown requests. However, residual risk persists due to the potential for credential reuse by victims. Users who entered login details on this site should assume compromise and initiate password resets for Naver and any accounts sharing the same credentials. Organizations are advised to monitor for unauthorized access attempts linked to this campaign and update blocklists to include the domain and associated IP address. The use of Tencent EdgeOne’s infrastructure suggests a pattern of abuse of content delivery networks for phishing operations, warranting further scrutiny of similar domains.