home-lidofinanct[.]webflow[.]io

This domain, home-lidofinanct.webflow.io, is identified as a brand impersonation threat targeting Lido, a prominent cryptocurrency staking platform. Analysis indicates the domain was repurposed to mimic legitimate Lido services, likely to deceive users into disclosing sensitive credentials or transferring assets. No explicit drainer kit signatures were detected, but the domain exhibits characteristics consistent with phishing infrastructure, including the use of a legitimate hosting provider and SSL certificate to lend false credibility. Infrastructure analysis reveals the domain resolves to the IP address 172.64.151.8, a Cloudflare-associated endpoint. Detection metrics from VirusTotal show 3 out of 95 security vendors flagging the domain as malicious, a modest but notable detection rate. The domain was originally registered on May 8, 2013, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. The SSL certificate is issued by Google Trust Services, further complicating detection by end-users. The domain appears on one security blocklist and is currently categorized with an elevated risk level due to its association with brand impersonation. As of the latest assessment, home-lidofinanct.webflow.io has been taken offline, likely in response to security vendor reports or hosting provider intervention. However, residual risk remains due to the domain's historical use and potential for reactivation. Users who interacted with the domain prior to its takedown should assume credential exposure and take immediate remediation steps, including revoking active sessions, rotating passwords, and monitoring for unauthorized transactions. Organizations are advised to update blocklists and educate users on recognizing brand impersonation tactics in cryptocurrency-related phishing campaigns.