sidrachainlogin[.]com

PhishDestroy identifies sidrachainlogin.com as an active credential-phishing domain that masquerades as the legitimate SidraChain login portal to harvest cryptocurrency wallet credentials and drain digital assets. Distributed via IP 104.21.19.30 and protected by a Let’s Encrypt SSL certificate, the site is engineered to appear authentic at a glance, leveraging stolen branding and a recently registered domain name to bypass initial scrutiny.

Technical indicators solidify its threat profile: the domain was created on November 29, 2025—just days before this advisory—indicating a fast-turnaround campaign with low dwell time designed to evade long-term blocklisting. Registered through TuringSign Inc. d/b/a Cosmotown, it currently evades detection on VirusTotal with a perfect score of 0 detections out of 95 scanners, demonstrating how quickly new phishing domains can slip past automated defenses. The absence of detections underscores the need for proactive real-time threat intelligence rather than relying solely on static reputation feeds.

Users who visited sidrachainlogin.com should immediately assume their credentials may have been compromised and take immediate action. Disconnect any connected wallets, revoke session tokens, and transfer assets to a newly generated cold wallet. Rotate passwords and enable two-factor authentication on all related accounts, and scan devices for malware. Report the domain to PhishDestroy for takedown and block it at the network level to prevent further access.