lido-do-finance[.]webflow[.]io

This report details a malicious domain, lido-do-finance.webflow.io, which impersonates the legitimate Lido brand for cryptocurrency scams. The site displayed a "404 - Page not found" title, indicating it may have been taken down or is currently offline. The primary threat is social engineering, as confirmed by Google Safe Browsing, which flagged the domain for social engineering. This site likely attempted to trick users into providing sensitive information or transferring cryptocurrency under the false pretense of being associated with the legitimate Lido decentralized finance platform.

Technical analysis reveals the domain was flagged by 11 out of 95 VirusTotal vendors. It is registered with MarkMonitor, Inc. and was created on 2013-05-08. The domain resolves to IP address 172.64.151.8, located in the United States, hosted by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1. The domain's nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. It is listed on one blocklist.

The domain is currently down or offline, which mitigates immediate risk. However, the confirmed social engineering flag and impersonation of a well-known brand indicate a high potential for harm if the site were active. Users should be advised to avoid any interaction with this domain or similar variations. The risk level is considered high due to the targeted nature of the scam.