lido[.]as-exclusiv[.]net

PhishDestroy has identified lido.as-exclusiv.net as a confirmed brand impersonation domain, specifically targeting the Lido brand. This domain is an elevated risk phishing site designed to deceive users into believing they are interacting with legitimate Lido services. The threat type is brand impersonation, and the site was likely used to harvest credentials or sensitive information from unsuspecting victims.

Technical analysis reveals that the domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating moderate detection. It was registered through Cronon GmbH, a German registrar, and resolves to the IP address 85.215.129.47. The domain was created on February 11, 2013, which is unusual for a phishing site as it gives it an aged appearance to bypass some security filters. It appears on 2 security blocklists and uses a Let's Encrypt SSL certificate (R12), which is common among phishing sites due to its free and automated issuance.

As of the latest analysis, the domain has been taken offline, which is a positive outcome. However, users should remain vigilant as similar domains may emerge. PhishDestroy recommends that users who may have interacted with this site change their credentials for any associated Lido accounts and monitor for suspicious activity. The remaining risk is low due to the domain's offline status, but the site's aged creation date and SSL certificate highlight the sophistication of modern phishing operations.