testnet[.]fi

This domain, testnet.fi, is actively impersonating Lido, a liquid staking protocol, as indicated by the page title 'Lido Liquid Staking' and confirmed brand target data. Analysis reveals the domain resolves to 104.18.24.25, a Cloudflare-hosted IP located in Canada, and employs HTTP/3 and HSTS, suggesting an attempt to appear legitimate through modern security protocols. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious domains. The domain is currently flagged by one security blocklist and has a trust score of 0/100, indicating high risk. Fifteen of 91 security vendors on VirusTotal have detected this domain as malicious, though the absence of additional context limits definitive classification of the specific attack vector. Defenders should treat this domain as high-risk for brand impersonation, particularly targeting users of Lido or similar staking services. Immediate actions include blocking the domain and IP at the network level, monitoring for related phishing campaigns, and alerting users to verify the authenticity of any communications or websites claiming affiliation with Lido. Further investigation into associated infrastructure, such as subdomains or linked wallets, is recommended to assess the full scope of the threat.