lidof[.]fi

lidof.fi has been flagged as a high-risk domain engaged in brand impersonation, specifically targeting the brand Lido. The domain is currently active and serves a page with the title 'Just a moment...'. Infrastructure analysis indicates it resolves to the IP address 188.114.97.3, which is located in Canada and associated with CloudFlare, Inc. The domain has been scanned in threat intelligence databases and appears in three separate threat intelligence pulses from AlienVault OTX. Additionally, it has been blocked by security services such as PhishDestroy, MetaMask, and SEAL, indicating recognized malicious activity. The HTTP status code returned by the domain is 301, suggesting a potential redirection mechanism, which is often employed in scams to direct users to malicious sites. It is important to note that while the domain has not triggered alerts in VirusTotal's scans, this absence of detections does not imply safety. Defenders should monitor this domain closely and consider implementing blocklists to prevent user interactions, as it is already noted on three security blocklists.