lido-finance-fi[.]typedream[.]app

Analysis of the domain lido-finance-fi.typedream.app indicates it was actively impersonating Lido, a cryptocurrency staking platform, as of July 23, 2026. The domain has since been taken offline, returning an HTTP 403 status with no resolvable nameservers. Infrastructure analysis reveals it was hosted on Cloudflare (AS13335) and resolved to 188.114.97.3, an IP address geolocated in the United States. The SSL certificate was issued by Google Trust Services, specifically the WE1 intermediate, a common choice for both legitimate and malicious sites. Detection data shows the domain was flagged for social engineering by Google Safe Browsing and appears on at least one security blocklist, PhishDestroy.

Sixteen of 95 security vendors on VirusTotal classified the domain as malicious, though the exact nature of the detections—whether phishing, malware, or other abuse—is not specified in available intelligence. The page title, 'Lido Finance | Staking,' directly aligns with the targeted brand, reinforcing the classification as a crypto scam. Technologies detected on the domain include Node.js, React, Next.js, Webpack, and Google Cloud services (Trace and CDN), suggesting a modern web stack likely used to replicate the appearance of a legitimate staking platform. The use of typedream.app as a subdomain platform indicates the attacker may have leveraged a legitimate service to host the phishing content, a tactic observed in other brand impersonation campaigns.

Defenders should treat this domain as high-risk due to its confirmed offline status, blocklist presence, and alignment with known crypto scam patterns. While the domain is no longer resolving, historical DNS and WHOIS records should be preserved for further investigation. Organizations targeted by Lido impersonation schemes should monitor for similar domains using typedream.app or other subdomain services, particularly those mimicking staking or DeFi platforms.