stakeonlido[.]com

The domain stakeonlido.com was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 104.21.16.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented an SSL certificate labeled WE1, indicating the use of a standard Cloudflare‑issued certificate rather than a brand‑specific or extended‑validation credential. The page title observed before takedown was "Ethereum Gas Refund | Get your lost ETH transaction gas fees," directly referencing a cryptocurrency refund narrative and aligning with the reported scam type of a crypto scam. The domain is explicitly identified as impersonating the Lido brand, a well‑known Ethereum staking service, and therefore constitutes a brand‑impersonation threat.

Detection data shows that three of ninety‑three security vendors on VirusTotal flagged the domain, providing early malicious‑activity indicators. AlienVault OTX includes the domain in a single threat‑intelligence pulse, and two independent blocklists—PhishDestroy and ScamSniffer—have added stakeonlido.com to their deny lists. These multiple sources corroborate the malicious intent and reinforce the elevated risk rating. No additional public blocklist entries or Safe Browsing records were noted beyond those cited.

Given the combination of a brand‑targeted lure, the use of a generic Cloudflare infrastructure, and the presence on reputable blocklists, defenders should proactively block traffic to stakeonlido.com at the network perimeter and update endpoint protection signatures. Continuous monitoring of newly registered domains that combine the words "stake" and "lido" or that reference Ethereum gas refunds is advised, as threat actors may iterate on this naming pattern.