enter-lido[.]xyz

This domain, enter-lido.xyz, was registered on April 22, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. DNS resolution points to 104.21.71.166, an address owned by Cloudflare (AS13335) located in the United States. The domain uses Cloudflare’s earl.ns.cloudflare.com and virginia.ns.cloudflare.com authoritative name servers and presents a Let's Encrypt certificate (CN=YE1). Security telemetry shows the site impersonates the Lido brand, and it has been classified as a brand‑impersonation scam.

Five of ninety‑one VirusTotal scanners flagged the domain as malicious, and three independent blocklists have added it to their deny lists. Additional defensive products—PhishDestroy, MetaMask, and SEAL—have also blocked the domain. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. The combination of a recent registration, use of a shared Cloudflare IP, low trust score, and multiple vendor detections suggests a purpose‑built phishing infrastructure targeting users of the Lido service.

Because the site is offline, active payloads cannot be inspected, and no page‑title or content snapshot is available; therefore the exact phishing vector remains unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or movement to a different IP, and add the IP address 104.21.71.166 to existing threat‑intel feeds. Incident response teams should also correlate any Lido‑related authentication attempts with this indicator and consider user‑awareness messaging that references the specific domain name to reduce the risk of future impersonation attempts.