my-lido[.]webflow[.]io

The domain my-lido.webflow.io is a brand impersonation phishing site specifically targeting the Lido cryptocurrency platform. It poses a significant threat by attempting to deceive users into believing it is an official Lido service, though no drainer kit was detected. The site is currently taken offline, but its history indicates it was designed for cryptocurrency-related scams.

Technical indicators for my-lido.webflow.io include detection by 13 of 95 VirusTotal vendors, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. It was registered through MarkMonitor, Inc. on May 08, 2013, and resolves to IP address 104.18.36.248 (US, AS13335 Cloudflare, Inc.). The domain appears on 1 security blocklist (PhishDestroy), and its SSL certificate is issued by Google Trust Services / WE1. The page title observed was '404 - Page not found', and technologies detected include Cloudflare and HTTP/3. Google Safe Browsing did not flag the domain.

For safety, because this domain was a cryptocurrency phishing scam, users who may have interacted with it should immediately revoke any token approvals given to the site and move funds to a new, secure wallet. Change any passwords that may have been entered, enable two-factor authentication on all accounts, and monitor for fraudulent activity. Report the domain to PhishDestroy and other security platforms to help block future threats.