bafybeian4zt4p7vnsmhrdxd255ieqqdhfdnlchf2l46lwhfuz57bvwyoiy[.]ipfs[.]dweb[.]link

This domain, bafybeian4zt4p7vnsmhrdxd255ieqqdhfdnlchf2l46lwhfuz57bvwyoiy.ipfs.dweb.link, presents an elevated-risk brand impersonation threat targeting Naver users. The site displays a fraudulent login page titled "네이버 : 로그인," designed to deceive visitors into entering credentials for the legitimate Naver platform. Such impersonation attempts typically aim to harvest sensitive information, including usernames, passwords, and potentially two-factor authentication codes, which threat actors may later exploit for unauthorized account access, financial fraud, or further phishing distribution. Analysis indicates the domain was created on February 24, 2017, and is registered through CSC Corporate Domains, Inc. It resolves to the IP address 209.94.90.2, located in the United States under AS40680 (Protocol Labs). The domain is flagged by 18 out of 95 security vendors on VirusTotal, including listings on two blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (serial number E7), a common practice among malicious actors to lend superficial legitimacy to phishing infrastructure. Despite its age, the domain's active use in this campaign aligns with known tactics of repurposing older domains to evade initial detection. Individuals who visited this domain or entered credentials on the fraudulent login page should take immediate action. First, change the password for any Naver account or other services where identical credentials may have been reused. Enable multi-factor authentication if not already active. Monitor the affected account for unauthorized activity, such as unfamiliar logins, sent messages, or financial transactions. If financial or personal data was exposed, consider reporting the incident to relevant authorities and credit monitoring services. Users should also scan their devices for malware, as some phishing pages deploy malicious scripts to capture additional data or establish persistence. Finally, verify the legitimacy of any unexpected communications claiming to be from Naver, as follow-up attacks may occur.