lido--finances[.]webflow[.]io

This domain, lido--finances.webflow.io, poses a brand-impersonation threat targeting users of Lido, a decentralized finance protocol. The site was designed to mimic legitimate Lido Finance interfaces, likely to harvest credentials, private keys, or other sensitive financial data from unsuspecting victims. Analysis indicates the domain was structured to exploit trust in the Lido brand, potentially through fake staking portals, airdrop scams, or fraudulent support pages. The presence of a 404 error suggests the site may have been taken down or moved, but its infrastructure remains a documented threat. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, indicating malicious classification by at least two independent engines. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though the subdomain lido--finances.webflow.io appears to have been created later for malicious purposes. It resolves to the IP address 172.64.151.8 and is associated with Cloudflare and HTTP/3 technologies, which are often leveraged to obscure hosting origins. Additionally, the domain appears on one security blocklist, further confirming its malicious intent. Users who visited lido--finances.webflow.io should assume potential exposure of sensitive data. Immediate actions include revoking any wallet permissions granted to the site, rotating passwords for associated accounts, and monitoring financial transactions for unauthorized activity. If cryptocurrency was transferred or private keys entered, victims should consider funds at risk and report the incident to relevant financial authorities. Infrastructure analysis reveals the use of Google Trust Services SSL certificates, which does not mitigate the domain's malicious nature. Continuous vigilance is advised, as similar domains may re-emerge under different subdomains or aliases.