69b879190aad566a6c550065--gleaming-halva-45b548[.]netlify[.]app

The domain gleaming-halva-45b548.netlify.app is a high-risk brand impersonation threat currently active and targeting Facebook. The page title '네이버 : 로그인' suggests an attempt to mislead users into believing they are accessing a legitimate Facebook login page.

Analysis indicates that the domain is registered through Netlify and resolves to the IP address 35.157.26.135, which is located in Germany (DE) and is part of the AS16509 network operated by Amazon.com, Inc. The SSL certificate is issued by DigiCert Inc, using the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating a moderate to high level of suspicion. It appears on 1 security blocklist, specifically PhishDestroy, further corroborating its malicious nature. The domain's trust score is low, and it is actively being monitored for malicious activity.

The current status of the domain is active, and it continues to pose a significant risk to users who may be tricked into providing their Facebook credentials. Recommendations include immediate blocking of the domain by network administrators and security teams. Users are advised to verify the URL and SSL certificate of any login page, especially when redirected from unfamiliar sources. Additionally, organizations should educate their employees about the signs of brand impersonation and the importance of using official channels for accessing services.