servactlvity[.]nice-try-firs[.]info

This domain, servactlvity.nice-try-firs.info, operates as a credential harvesting site specifically targeting Apple users. Analysis of the page title, 'Coinbase - Sign In,' suggests an attempt to deceive users into entering sensitive login credentials under false pretenses, likely leveraging social engineering tactics to mimic legitimate authentication portals. The domain impersonates Apple, a high-value target for threat actors seeking to exploit trust in widely recognized brands for financial gain or further compromise. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its fraudulent nature. It resolves to the IP address 50.6.18.191, hosted under AS31898 (Oracle Corporation) in the United States, and was registered through ASN 19871 (UNIFIEDLAYER-NETWORK-16). The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and lacks SSL certification, further reducing its legitimacy. These factors collectively contribute to an elevated risk assessment. Users who visited servactlvity.nice-try-firs.info should take immediate remedial action. If credentials were entered, reset passwords for Apple and any other accounts where the same credentials may have been reused. Enable multi-factor authentication where available to mitigate the risk of unauthorized access. Monitor financial and account activity for signs of compromise, such as unauthorized transactions or login attempts. Additionally, consider scanning the device used to access the site for malware or unauthorized modifications, as credential harvesting sites may deploy additional payloads to maintain persistence or exfiltrate further data.