lidodsstakking[.]gitbook[.]io

Analysis of lidodsstakking.gitbook.io shows a high‑risk brand‑impersonation campaign targeting users of the Lido liquid‑staking service. The domain resolves to IP address 104.18.40.47, which is owned by AS13335 Cloudflare, Inc. and located in the United States. Nameserver configuration uses dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, both Cloudflare‑managed, indicating that the infrastructure is fully hosted behind Cloudflare’s edge network. Registration information lists Cloudflare, Inc. as the registrar, and the domain creation date is recorded as March 30, 2014, suggesting a long‑standing registration that may have been repurposed for malicious activity. The site presents the page title "Lido Staking% | A complete guide to Ethereum's liquid staking …," which directly references the Lido brand and aligns with the declared scam type of a crypto scam.

Multiple security signals corroborate the malicious nature of the domain. It appears on one security blocklist and is flagged by PhishDestroy. VirusTotal reports 13 detections out of 93 scanned security vendors, providing independent confirmation of suspicious behavior. Google Safe Browsing classifies the site as social engineering, reinforcing the likelihood of phishing or credential‑harvesting tactics. The SSL certificate is issued by Google Trust Services under the WE1 root, and the site responds with an HTTP 307 redirect, a pattern often used to forward victims to fraudulent landing pages. The infrastructure runs Cloudflare services and HTTP/3, which are common to both legitimate and malicious sites, offering no distinguishing advantage.

The Gridinsoft trust score of 0 out of 100 is the lowest possible rating, indicating that at least one reputable anti‑malware engine considers the domain entirely untrustworthy. No evidence beyond the listed indicators has been disclosed regarding the actual content or payload of the site, leaving the precise phishing methodology uncertain.