mocaupdate[.]live

PhishDestroy identifies mocaupdate.live as an active credential phishing domain designed to steal login credentials and cryptocurrency wallet access. The site mimics legitimate update portals—especially for mobile applications or system tools—to trick users into entering sensitive information. Once credentials or wallet seed phrases are submitted, attackers immediately harvest and exploit them to drain crypto funds or hijack accounts. This domain poses an elevated threat because it combines social engineering with fake urgency, such as “mandatory update required” prompts, to bypass user caution. This domain was flagged by PhishDestroy after appearing on two security blocklists and being detected by MetaMask and SEAL threat intelligence systems. VirusTotal analysis shows only 1 out of 95 security vendors currently detect it, highlighting its stealth. The domain was registered on March 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for anonymity and bulk registrations. It uses a Let's Encrypt SSL certificate and resolves to IP 104.21.54.90, a hosting provider frequently associated with low-reputation domains. If you visited mocaupdate.live, immediately disconnect from the site. Do not enter any passwords, recovery phrases, or wallet keys. Scan your device with updated antivirus and change passwords for critical accounts using a separate secure device. If you entered crypto wallet information, transfer remaining assets to a new wallet immediately and revoke any connected app permissions. Report the domain to your browser’s security team or platforms like PhishDestroy to help block future access. Monitor financial accounts and crypto wallets closely for unauthorized activity over the next 30 days.