lido[.]exchange

Analysis of lido.exchange shows an active infrastructure that is deliberately crafted to masquerade as the Lido brand. The domain was registered on 23 December 2025 through Spaceship, Inc. and resolves to the Amazon‑owned IP address 54.149.79.189, which is associated with ASN 16509 in the United States. The hosting environment reports Node.js, Envoy, Express, HSTS and Akamai components, indicating a modern web stack possibly used to serve dynamic content. The DNS configuration uses the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net, both belonging to the same registrar. The SSL certificate is issued by Go Daddy Secure Certificate Authority – G2 and is currently valid, which can help the site appear legitimate to unsuspecting users.

An HTTP request returns status 200 and the page title is “Parking Page”, suggesting the site is either in a placeholder state or deliberately minimal to avoid detection. The domain has been flagged by PhishDestroy and appears on one additional security blocklist, and six of ninety‑three VirusTotal scanners have raised alerts, reflecting moderate detection confidence. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The site is categorized as a crypto scam, consistent with the brand impersonation of Lido, a well‑known staking service. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because no page content has been captured, and the simple parking page provides no further technical indicators.

Defenders should immediately block traffic to lido.exchange at the network perimeter, add the associated IP 54.149.79.189 to any threat‑intelligence feeds, and monitor for similarly named domains that resolve to the same hosting provider. Continuous TLS inspection is advised to detect any future changes in the certificate or payload delivery.