sfpidn[.]com

PhishDestroy identifies sfpidn.com as an active crypto drainer domain currently stealing digital assets from unsuspecting visitors. This website masquerades as legitimate login portals or investment dashboards, automatically draining connected cryptocurrency wallets the moment a victim authorizes a transaction. The threat is elevated due to the combination of hard-to-detect wallet drainers and the domain's recent registration, giving victims little time to react once authorization is granted. This domain was flagged by 7 out of 95 VirusTotal security vendors, indicating widespread suspicion in the cybersecurity community. sfpidn.com was created on April 18, 2026, just days ago, and is registered through Name SRS AB, a registrar known for both legitimate and questionable domain acquisitions. The site operates behind a Let’s Encrypt SSL certificate, which provides a false sense of security by showing HTTPS in browsers, despite serving malicious content. Behind the domain sits IP address 104.21.3.137, a hosting infrastructure associated with multiple fraudulent activities targeting crypto users. If you visited sfpidn.com or entered any information, disconnect your wallet immediately and check for unauthorized transactions. Run a full malware scan on your device and revoke any suspicious permissions granted to websites or browser extensions. Report the domain to PhishDestroy for further analysis and share your experience with the community to help others avoid falling victim to this active crypto drainer.