sfpidn[.]cc

PhishDestroy identifies sfpidn.cc as an elevated-risk domain actively engaged in credential theft operations. This site mimics legitimate services to trick users into surrendering sensitive login details, exposing victims to account takeovers, financial fraud, or identity theft. Technical analysis confirms the domain resolves to IP 172.67.181.194 and is protected by a Let’s Encrypt SSL certificate, using encryption to appear trustworthy while hosting malicious content. The domain was registered on April 18, 2025 through Gname.com Pte. Ltd., a known registrar often abused by threat actors for short-lived phishing campaigns. This threat assessment is supported by 11 out of 95 VirusTotal security vendors, including leading engines like Google Safe Browsing and PhishTank, which flag sfpidn.cc as a confirmed phishing resource. Such low detection rates coupled with recent domain registration are consistent with fast-moving, opportunistic credential harvesting campaigns targeting unsuspecting users globally. If you have visited sfpidn.cc, immediately stop entering any personal or login information. Change passwords on all affected accounts using a different device or network. Enable two-factor authentication where possible and run a full system scan using up-to-date antivirus software. Report the domain to your email provider, browser security teams, and platforms like Google Safe Browsing to help block further access.