lido-finance-staking[.]typedream[.]app

Analysis of lido-finance-staking.typedream.app shows a domain that was actively used to impersonate the Lido brand and promote a cryptocurrency‑related scam. The site was registered on January 22, 2021 through Squarespace Domains II LLC and resolves to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS resolution is handled by the Cloudflare authoritative nameservers annalise.ns.cloudflare.com and darwin.ns.cloudflare.com. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 intermediate, indicating a valid‑looking HTTPS configuration that could lend credibility to malicious links.

An HTTP request to the domain now returns a 404 status, and the current operational status is recorded as offline, suggesting the site has been taken down or is no longer serving content. The page title captured during previous scans – "Lido Finance: Complete Guide to Liquid Staking ETH" – directly references the Lido brand, confirming intentional brand impersonation. Technical fingerprinting reveals a modern web stack comprising Node.js, React, Next.js, Google Cloud services (Trace and CDN), Cloudflare, and Webpack, a combination frequently observed in phishing or scam clones that aim to mimic legitimate financial portals. VirusTotal analysis shows that nine out of ninety‑five security vendors flagged the domain as malicious, providing independent vendor consensus of suspicious behavior.

The domain is listed on one external security blocklist and has been specifically blocked by the PhishDestroy mitigation service, reinforcing the assessment of malicious intent. While the site is presently offline, the historical evidence demonstrates that the infrastructure was employed for a crypto‑draining campaign targeting users searching for Lido staking information.