lidofi[.]click

PhishDestroy identifies lidofi.click as a high-risk domain engaged in active brand impersonation targeting Lido, a leading liquid staking protocol. The site presents a replica of the legitimate 'Lido Liquid Staking' interface, designed to deceive users into connecting wallets or submitting credentials under the guise of the official Lido service. While no drainer kit artifacts were explicitly observed in available telemetry, the page title and visual presentation strongly suggest the deployment of a credential-harvesting or wallet-draining mechanism typical of impersonation phishing campaigns. This domain should be treated as malicious and avoided entirely due to its clear intent to exploit user trust in the Lido brand for financial gain or credential theft. lidofi.click resolves to IP 104.21.78.31 and was registered through NameSilo, LLC on January 01, 2026. The domain currently holds a Let's Encrypt SSL certificate, enhancing its appearance of legitimacy. VirusTotal analysis shows a detection ratio of 1/95 security vendors, indicating low but present suspicion. It is not currently flagged on Google Safe Browsing (GSB) and has not yet accumulated significant listings on major blocklists. This suggests either a very recent deployment or low-volume targeting, but the lack of widespread detection does not equate to safety. The combination of a fraudulent title, recent registration, and vulnerable hosting environments increases the likelihood of successful phishing operations against cryptocurrency users. As of the latest scan, lidofi.click remains active and unblocked by default security measures. Immediate action is advised: users should avoid visiting the domain, and organizations should update network blocklists with the IP (104.21.78.31) and domain (lidofi.click). The residual risk is high due to the domain’s active status, brand targeting, and the absence of widespread countermeasures. Given the pace of crypto phishing operations, this threat could escalate rapidly. Users interacting with staking or DeFi platforms are urged to verify URLs via official Lido channels and enable wallet transaction simulation to detect unauthorized fund movements.