pageup-lidofinance[.]webflow[.]io

The domain pageup-lidofinance.webflow.io was registered on February 21, 2026 through NameCheap, Inc. and resolves to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title "Lido Finance | Official Site," directly referencing the legitimate Lido brand, and is classified as a crypto‑scam that impersonates Lido. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating the connection is encrypted but does not validate the underlying content. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports detections from five of ninety‑three scanning vendors, confirming malicious characteristics.

The domain is currently offline, returning an HTTP 404 status, and has been blocked by multiple threat‑remediation services, including PhishDestroy, MetaMask, and SEAL. It also appears on three external blocklists. Detected infrastructure includes Cloudflare’s edge network and support for HTTP/3, which are common for both legitimate and fraudulent services.

While the site is no longer reachable, the historical evidence shows a deliberate brand impersonation campaign targeting users of Lido Finance. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host or similar subdomains, and update endpoint and web‑filter signatures to include the observed page title and SSL fingerprint. Additionally, threat‑intel teams should flag the registrar NameCheap and the Cloudflare IP range as part of broader watchlists for crypto‑related phishing infrastructure, given the repeated use of these assets in recent impersonation attempts.