lidoilstaking[.]gitbook[.]io

Analysis of lidoilstaking.gitbook.io indicates an active brand‑impersonation campaign targeting users of the Lido staking service. The domain was created on 27 February 2026 and is hosted behind Cloudflare’s network (nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com). The site resolves to IP 104.18.40.47, associated with AS13335 (Cloudflare, Inc.) in the United States and serves a TLS certificate issued by Google Trust Services under the WE1 profile. HTTP traffic is served over HTTP/3 and returns a 307 temporary redirect, a pattern frequently observed in malicious redirects. The page title “Lido Staking – Securely Earn Rewards | us” mimics official Lido messaging, confirming the brand‑impersonation intent. The domain appears on three public blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports a single vendor detection among 93 scanners, reinforcing the suspicion of malicious content. While the exact payload or credential‑collection mechanism has not been publicly disclosed, the infrastructure choices—Cloudflare front‑end, TLS from a trusted CA, and a redirect response—are consistent with phishing‑as‑a‑service deployments that aim to evade simple URL‑based filters. Defenders should immediately add lidoilstaking.gitbook.io to URL blocklists, monitor DNS queries for the associated IP address, and alert users that any unsolicited communications referencing “Lido Staking” should be verified through official channels. Ongoing collection of the site’s content and network behavior is recommended to determine whether the redirect leads to credential‑harvesting forms or malicious binaries.