navietkoreeark-aqnxoqtjhvmkvvrhmxsrmctf[.]pages[.]dev

Analysis indicates that navietkoreeark-aqnxoqtjhvmkvvrhmxsrmctf.pages.dev is an active phishing domain targeting Korean-speaking users, as evidenced by the page title '회원정보 고객센터' (Member Information Customer Center). The domain was registered on March 11, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.146. Infrastructure analysis reveals the use of Cloudflare's hosting services, which is consistent with observed patterns in phishing campaigns leveraging content delivery networks to obscure origin servers. Detection metrics from multiple sources confirm malicious classification: Gridinsoft and Scamadviser both assign trust scores of 0/100 and 1/100, respectively, and the domain appears on at least one security blocklist. A scan by 95 security vendors identified 15 detections, further supporting the phishing classification. The site employs common web technologies including Node.js, React, Next.js, and jQuery, alongside Naver Analytics, which may be used for tracking victim interactions. At present, the exact brand being impersonated remains unconfirmed, as the page title does not specify a corporate entity. However, the Korean-language interface and use of Naver Analytics suggest a focus on users within South Korea. Defenders are advised to block the domain and IP address at the network level, monitor for related subdomains under the *.pages.dev namespace, and alert users to the presence of Korean-language phishing portals. Given the domain's continued activity as of July 12, 2026, immediate mitigation is recommended.