celadon-nasturtium-970989[.]netlify[.]app

The domain celadon-nasturtium-970989.netlify.app has been identified as a credential phishing site specifically targeting users of Kakao email services. Analysis indicates this domain operated under the guise of a legitimate account verification page, as evidenced by the page title 'Kakao Account.' The site is currently offline, though prior activity suggests it was actively harvesting login credentials. Infrastructure analysis reveals the domain was hosted on Netlify’s platform and resolved to the IPv6 address 2a05:d014:58f:6200::259, geolocated within Germany under Amazon.com, Inc.’s autonomous system AS16509. The SSL certificate was issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain. Detection metrics indicate significant malicious classification, with 17 of 95 security vendors on VirusTotal flagging the domain as phishing-related. Additionally, the domain appeared on two independent security blocklists, further corroborating its malicious intent. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access to email accounts, particularly those associated with Kakao services. Network administrators should update firewall rules to block the domain and its associated IP address. Users who may have entered credentials on this site should immediately reset passwords and enable multi-factor authentication where available. Proactive threat hunting is recommended to identify any compromised accounts linked to this phishing campaign.