mocoyuk[.]kedirikota[.]go[.]id

PhishDestroy has identified mocoyuk.kedirikota.go.id as a confirmed phishing site designed to steal login credentials through a fraudulent login page. The domain masquerades as an official government portal, likely to trick users into entering sensitive information such as usernames and passwords. This specific threat is categorized as generic phishing, meaning it does not target a specific brand but instead uses a generic login interface to harvest credentials from unsuspecting visitors.

Evidence gathered during investigation shows that the domain was created on March 27, 2026, a very recent date that aligns with typical phishing operations. It resolves to IP address 103.78.106.119 and is registered through PANDI Registrar. VirusTotal reports 0 out of 95 security vendors detecting the domain as malicious, indicating it has not yet been widely flagged. However, it appears on 1 security blocklist, confirming that at least one threat intelligence source has identified it as risky. The domain's SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA OV R36, which is a legitimate certificate authority, adding a veneer of credibility to the scam.

If you have visited mocoyuk.kedirikota.go.id and entered any personal information, you should immediately change passwords for any accounts that may have been compromised and enable two-factor authentication where available. Monitor your accounts for suspicious activity and consider using a credit monitoring service. As the domain is currently offline, the immediate threat is contained, but similar phishing sites may emerge. PhishDestroy recommends staying vigilant and verifying the authenticity of any login page before entering credentials.