xn--o39as5ypsfu9ht2l[.]com

This domain, xn--o39as5ypsfu9ht2l.com, is identified as a phishing site impersonating MegaTOON, a premium webtoon platform. The page title "MegaTOON - 프리미엄 웹툰 플랫폼" explicitly mimics the branding of legitimate webtoon services, suggesting an intent to deceive users into entering credentials or financial information under false pretenses. No specific drainer kit signatures were observed, but the domain aligns with patterns of credential harvesting or subscription fraud targeting Korean-speaking audiences.

Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.7.183, which is proxied behind Cloudflare infrastructure, a common tactic to obscure hosting origins. The domain is flagged by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is currently not detected by Google Safe Browsing. Technologies detected include Cloudflare and HTTP/3, further supporting the use of modern evasion techniques.

As of the latest assessment, the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains due to the domain's recent creation date and the potential for re-registration or migration to new infrastructure. Organizations should monitor for related domains using similar Unicode characters or branding elements, and users should be advised to verify URLs before entering sensitive information on webtoon or content subscription platforms.