sideline[.]today

PhishDestroy analysts have identified sideline.today as a credential theft domain designed to impersonate a Google login page, tricking users into entering their credentials. The site was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolves to IP address 188.114.97.3. Its SSL certificate was issued by Google Trust Services, adding a false sense of legitimacy. The page title was found to be "Loading...", a common tactic used by phishing kits to display a fake loading screen while harvesting input.

Technical indicators confirm the threat: VirusTotal reports 3 out of 95 security vendors flagging this domain, and it appears on one security blocklist. The domain was created very recently, suggesting a short-lived campaign. Google Safe Browsing (GSB) status is not explicitly mentioned, but the domain has been taken offline. The use of a generic page title and recent registration are red flags consistent with phishing operations.

As of the latest assessment, sideline.today is offline, likely due to takedown actions by hosting providers or registrar intervention. However, users who may have already visited the site should change their passwords immediately and enable two-factor authentication on affected accounts. Remaining risk is low given the domain's inactive status, but users should remain vigilant for similar domains using variations of the same name or IP. PhishDestroy recommends avoiding any unsolicited login prompts and verifying URLs before entering credentials.