lido-lido[.]app

This domain, lido-lido.app, poses a high-risk brand impersonation threat targeting users of Lido, a liquid staking protocol. The site presents itself as a legitimate tutorial for Lido staking, with the page title 'Lido Staking Guide - Complete Tutorial for Liquid Staking.' However, analysis indicates it is designed to deceive visitors into disclosing sensitive information, such as wallet credentials or private keys, or into interacting with malicious smart contracts. The fraudulent nature of the site is further evidenced by its inclusion in crypto-related phishing campaigns, where users are lured under false pretenses of educational content or financial incentives. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain is flagged by 18 out of 95 security vendors on VirusTotal, a clear signal of its involvement in phishing activities. It was registered through Cloudflare, Inc., a provider frequently leveraged by threat actors to obscure ownership and hosting details. The domain resolves to the IP address 104.21.80.223, which is associated with Cloudflare's network (AS13335) and located in the United States. Despite its apparent legitimacy, the domain lacks an SSL certificate, a red flag for any site handling sensitive user data. Additionally, it appears on at least one security blocklist, and Google Safe Browsing has explicitly flagged it as a phishing site. The domain is currently offline, but its prior activity and infrastructure remain a concern for potential re-emergence. Users who visited lido-lido.app should take immediate action to mitigate potential risks. First, disconnect any wallets or accounts that may have interacted with the site and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Monitor connected accounts for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. Report the domain to relevant platforms, such as crypto security communities or the impersonated brand’s official support channels, to aid in broader threat mitigation. Exercise caution with similar domains, particularly those offering staking guides or financial tutorials, and verify the legitimacy of any site through official sources before engaging with it.