lidomigrate[.]live

The domain lidomigrate.live was registered on April 17, 2026 through OwnRegistrar, Inc. and is currently active. It is being used to impersonate the Lido brand, a high‑risk brand‑impersonation campaign targeting users of Lido services. The domain’s age of less than three months and its immediate appearance on multiple blocklists suggest an intentional malicious launch. Infrastructure analysis shows that lidomigrate.live resolves to the Cloudflare edge address 104.21.21.18, located in CA, United States, and is served by the Cloudflare nameservers nile.ns.cloudflare.com and joselyn.ns.cloudflare.com. The site presents a valid Let’s Encrypt certificate (E7) but returns HTTP 403 for all requests, preventing direct content inspection. Gridinsoft assigns a trust score of 0/100, indicating a lack of legitimacy. The domain appears on three security blocklists and is listed in an AlienVault OTX pulse, confirming community detection. It is also blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports a single vendor detection out of 95 scans, reflecting limited visibility but corroborating malicious intent. The combination of brand impersonation, low trust score, and blocklist inclusion drives the high risk rating. Defenders should add lidomigrate.live to network and DNS deny lists, monitor for any resolution to 104.21.21.18, and enforce TLS inspection to capture any future payload that may appear behind the current 403 barrier. Continuous re‑scanning of the domain with multiple AV engines is advised, as the low detection count may evolve. Threat‑intel teams should correlate any observed Lido‑related credential submissions with this infrastructure to attribute potential phishing attempts.