xcommonsupdate[.]live

The domain xcommonsupdate.live is actively engaged in credential phishing, with 2 out of 95 vendors on VirusTotal flagging it as malicious. It is also included in three public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The domain is registered with NiceNIC International Group Co., Limited and hosted on an IP managed by Cloudflare, Inc.

The phishing site displays a page titled "Just a moment..." which is a common tactic used by attackers to delay and distract users while malicious scripts load in the background. This domain was created and detected by PhishDestroy on the same day, February 21, 2026, indicating a rapid response to emerging threats. The use of Let's Encrypt for SSL certification suggests an attempt to appear legitimate and secure to potential victims.

The presence of this domain on multiple blocklists highlights its recognition as a threat by several cybersecurity entities. Despite the relatively low detection rate on VirusTotal, the listing on key blocklists underscores the domain's malicious intent. PhishDestroy's detection pipeline captures such threats in their early stages, often before they are widely recognized by antivirus vendors. This proactive approach helps mitigate the risks posed by newly registered phishing domains, which exploit the time lag in antivirus database updates.