withdraw-lido[.]finance

PhishDestroy identifies a live brand impersonation scam on withdraw-lido.finance, a fraudulent domain masquerading as Lido’s legitimate platform to deceive users into connecting wallets for fake withdrawal transactions. This domain was flagged by ScamSniffer and added to one security blocklist, indicating active abuse in the wild. Its SSL certificate, issued by Let’s Encrypt, lends a false sense of legitimacy, while VirusTotal analysis shows only 2 out of 95 security vendors currently detect the threat. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 4, 2026, and resolves to IP 188.114.96.3, a server associated with malicious crypto-themed operations. The threat is elevated due to the domain’s precise mimicry of Lido’s branding, leveraging the trusted name to trick users into authorizing fraudulent wallet connections. ScamSniffer’s detection and inclusion on one blocklist underscore its active misuse, while the low detection rate on VirusTotal highlights how quickly new impersonation sites can evade detection. The domain’s recent creation and association with a known registrar commonly used in phishing campaigns further validate its malicious intent. Users should avoid interacting with this domain entirely, as any interaction—especially wallet connections—could result in fund theft or credential compromise. If you’ve visited withdraw-lido.finance, immediately disconnect your wallet, revoke any unauthorized permissions via your wallet’s settings, and scan your device for malware. Report the domain to your antivirus provider and consider changing passwords if you entered credentials. Monitor your transaction history for unauthorized transfers and notify your bank or crypto exchange if fraud is suspected. For further investigation, review the full threat report and share any relevant indicators with your security team to prevent broader exposure.