compact-tan-u27htcil[.]edgeone[.]app

Analysis indicates that compact-tan-u27htcil.edgeone.app is currently active and serving HTTP 200 responses. The site presents the page title “네이버 : 로그인”, which translates to “Naver : Login”, a clear indicator of credential‑harvesting aimed at the Korean portal Naver. Infrastructure details show the domain is hosted via Tencent EdgeOne and resolves to IP 101.33.10.10, located in Germany (ACE). The SSL certificate is issued by DigiCert Secure Site OV G2, a legitimate CA, which does not mitigate the phishing risk. The page loads jQuery and Google Hosted Libraries, common components in fraudulent login clones. Security intelligence assigns a Gridinsoft trust score of 0/100 and reports that nine of ninety‑one VirusTotal scanners have flagged the domain. It is listed on one blocklist and is actively blocked by PhishDestroy. The domain is still marked as active. No additional evidence such as malicious payloads, command‑and‑control hosts, or exfiltration endpoints is available from the current data set. Defenders should treat the domain as high‑risk phishing infrastructure, block DNS resolution and HTTP traffic, monitor for related indicators such as the IP address 101.33.10.10, and consider adding the domain to internal blocklists. Continuous observation is advised to detect any evolution of the site’s content or additional infrastructure.