secureactivitysett726411[.]li

PhishDestroy identifies the domain secureactivitysett726411.li as an active credential phishing site impersonating a legitimate activity portal. The domain leverages a deceptive naming convention to trick users into entering login credentials under the guise of a secure activity management system. Threat actors are likely using this domain in phishing campaigns, emails, or social engineering tactics to harvest sensitive user data.

Technical analysis of secureactivitysett726411.li reveals a low initial detection profile with 13/95 VirusTotal detections, suggesting it is either newly deployed or employing evasion techniques. The domain resolves to IP address 82.221.136.24 and utilizes a Let's Encrypt SSL certificate, which may enhance its credibility. Further investigation under seed 149107 is ongoing to determine registrar details, creation date, Google Safe Browsing (GSB) status, and inclusion on blocklists.

The domain remains active and under investigation as of current assessment. Users are advised to avoid interacting with secureactivitysett726411.li and report any related suspicious activity. Immediate blocking of IP 82.221.136.24 and domain-level blocking are recommended. While the current risk is under evaluation, the lack of detections and active status warrant heightened vigilance. Regular monitoring and proactive threat intelligence updates are essential to mitigate potential credential theft campaigns.