lido-financ[.]webflow[.]io

The domain lido-financ.webflow.io is a confirmed phishing site engaged in brand impersonation targeting Lido, a cryptocurrency platform. It poses an elevated risk by attempting to deceive users into believing they are interacting with the legitimate Lido service, potentially leading to financial loss through cryptocurrency scams. No drainer kit was detected, but the site was actively flagged for social engineering before being taken offline.

Technical indicators confirm the malicious nature of lido-financ.webflow.io. As of analysis, 3 of 95 VirusTotal security vendors flagged the domain for phishing, and Google Safe Browsing marked it with the 'SOCIAL_ENGINEERING' label. The domain appears on 1 security blocklist (PhishDestroy) and is registered through MarkMonitor, Inc., with a creation date of May 08, 2013. It resolves to the IP address 172.64.151.8, hosted on Cloudflare’s infrastructure (AS13335) in the US, and uses an SSL certificate issued by Google Trust Services / WE1. The observed HTTP status was 404, with the page title '404 - Page not found', and the site employed Cloudflare and HTTP/3 technologies.

Users who interacted with lido-financ.webflow.io should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the phishing domain to the impersonated brand (Lido) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.