li--do--web[.]typedream[.]app

On July 23, 2026 analysts observed that the subdomain li--do--web.typedream.app resolves to the IP address 188.114.97.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain is registered through Cloudflare, Inc., and presents an SSL certificate issued by Google Trust Services under the label WE1, indicating a valid TLS handshake. Front‑end fingerprinting reveals a stack comprising Node.js, React, Next.js, Webpack, and Google Cloud services, while traffic is accelerated by Google Cloud CDN and Cloudflare’s edge network. The page title returned by the server is "Lido Finance | Staking," matching the targeted brand Lido.

Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 15 of 95 scanned security vendors classify the host as malicious. The domain appears on the PhishDestroy blocklist, confirming its inclusion in at least one public threat feed. HTTP probing returns a 404 status, and the site is currently taken offline, limiting direct content inspection. Nameserver information could not be retrieved (NS_NOT_FOUND), adding a minor gap in the DNS profile.

The collected evidence points to a high‑risk brand‑impersonation campaign aimed at deceiving users of Lido Finance, likely to solicit cryptocurrency staking deposits under false pretenses. Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, add the domain to internal blacklist feeds, and monitor for any future re‑registration attempts. Continuous observation of Cloudflare‑hosted assets linked to the same ASN is recommended, as threat actors often reuse infrastructure. Incident response teams should also correlate any internal logs for attempted connections to this host and verify that no credential leakage or unauthorized transactions have occurred.