ethget[.]top

Analysis of ethget.top indicates that the domain was registered on June 17 2025 through the registrar 耐思尼克国际集团有限公司. The site presented the page title “Check Eligibility for 40 ETH Airdrop | Lido”, directly referencing the Lido brand and suggesting an airdrop of 40 ETH. The infrastructure resolves to IP 104.21.27.230, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The SSL certificate is identified as “WE1”, providing no indication of extended validation. The domain carries a Gridinsoft trust score of 0 / 100, and five of ninety‑five VirusTotal scanners flagged it as malicious.

It is listed on two independent blocklists (PhishDestroy, ScamSniffer) and appears on two broader security blocklists. The observed kit is classified as an “Airdrop Scam”, matching the crypto‑scam typology. Current DNS resolution shows the domain as offline, but historical evidence suggests it was used to lure victims into submitting wallet credentials or private keys under the guise of a Lido‑branded airdrop. Uncertainty remains regarding the exact payload delivered to victims, as no page content beyond the title has been captured.

The short‑lived nature of the site and the use of Cloudflare’s CDN make attribution to a specific operator difficult. Defenders should block the domain and its associated IP at network perimeters, monitor for any residual traffic to the IP address, and add the domain to internal URL filtering lists. Incident response teams should also search for related indicators such as the “WE1” certificate fingerprint and the specific page title to detect any copycat campaigns. Continuous monitoring of the registrar and the Cloudflare ASN is recommended, as future campaigns may reuse the same hosting infrastructure.