nhnarticle-cafe[.]com

The domain nhnarticle-cafe.com masquerades as a legitimate Naver login page, specifically targeting South Korean users by mimicking the official '네이버 : 로그인' portal. This is a classic credential harvesting operation designed to steal usernames and passwords from unsuspecting visitors. The site poses a significant risk because it appears authentic and could trick even cautious users into entering their sensitive account details.

Evidence from multiple sources confirms the malicious nature of this domain. VirusTotal reports that 19 out of 95 security vendors flag it as malicious, a strong indicator of widespread detection. The domain was registered on April 16, 2026, through Name.com, Inc., and uses a Let's Encrypt SSL certificate (E7) to appear legitimate. It appears on at least one security blocklist, and the current status is offline, suggesting it has been taken down after being reported. The domain resolves to IP address 34.111.179.208, which may be associated with other phishing operations.

Users who visited nhnarticle-cafe.com and entered their Naver credentials should immediately change their passwords and enable two-factor authentication on their accounts. They should also monitor their accounts for any suspicious activity and report the incident to Naver's security team. PhishDestroy recommends that all users verify the URL of any login page before entering credentials, especially for high-value services like Naver. Staying vigilant and using security tools that block known phishing domains can prevent such attacks in the future.