lidk[.]fi

The domain lidk.fi has been identified as a credential theft phishing site, currently taken offline after being flagged by multiple security sources. This domain was designed to trick users into revealing sensitive login information, likely by impersonating a legitimate service through a deceptive login page titled "Just a moment...".

According to available threat intelligence, lidk.fi was flagged by 1 of 95 VirusTotal vendors and appears on 3 security blocklists. The domain was registered through Key-Systems GmbH and created on May 26, 2026, resolving to IP address 188.114.96.3. AlienVault OTX detected it in 4 threat intelligence pulses, and its SSL certificate was issued by Let's Encrypt under the E7 chain, which is commonly abused by malicious actors.

Although the domain is currently offline, organizations should ensure it is blocked on all network security appliances and maintain monitoring for any reactivation. Users who may have visited the site should change their passwords immediately and enable multi-factor authentication where possible. PhishDestroy recommends adding this domain to blocklists and conducting user awareness training to recognize credential theft attempts.