vote-lidofinance[.]xyz

The domain vote-lidofinance.xyz was identified as a brand impersonation threat specifically targeting Lido, a prominent liquid staking platform. This phishing domain was designed to deceive users into believing they were interacting with the legitimate Lido ecosystem, likely aiming to steal login credentials, private keys, or trick victims into authorizing malicious transactions through a drainer kit. The page title displayed 'Lido Liquid Staking,' further reinforcing the deceptive facade.

Technical analysis reveals that the domain resolved to IP address 188.114.96.3 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. It was created on March 13, 2026, and secured with a Let's Encrypt SSL certificate (E8). VirusTotal flagged the domain with a score of 3 out of 95 security vendors, indicating moderate malicious detection. Additionally, it appeared on 3 security blocklists, though notably not on Google Safe Browsing (GSB) at the time of analysis, which may have contributed to its initial visibility.

As of the current report, the domain has been taken offline, mitigating immediate risk to users. However, the PhishDestroy team advises continued vigilance as similar domains may appear under different variations. Users who may have interacted with vote-lidofinance.xyz should revoke any permissions granted and monitor accounts for suspicious activity. No credentials or wallet connections should be trusted on unofficial Lido domains; always verify URLs directly from official sources.