claim[.]lidoflnance[.]xyz

Analysis of claim.lidoflnance.xyz indicates a recent Lido brand impersonation campaign classified as a crypto scam. The domain was registered on November 5, 2024 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv6 address 2606:4700:3030::6815:3b1f, which belongs to Cloudflare, Inc. (AS13335). Both authoritative nameservers, desi.ns.cloudflare.com and venkat.ns.cloudflare.com, are Cloudflare‑hosted, confirming that the infrastructure is provided by the same CDN service. No SSL certificate was observed for the domain, meaning HTTPS connections would be unavailable or would fall back to an insecure HTTP endpoint.

The site title returned by the HTTP response is "Et øjeblik ...", a phrase unrelated to the Lido brand, suggesting that the page content has not been publicly disclosed or that the landing page is minimal. The domain appears on a single blocklist, PhishDestroy, and has been flagged by that service as a malicious resource. VirusTotal reports show that the domain was scanned by 95 vendors, none of which raised a detection; however, the absence of a detection does not constitute a safety assurance.

The current operational status is offline, limiting immediate interaction but indicating that the threat actor may reactivate the domain or use the same registration details for future campaigns. Defenders should add claim.lidoflnance.xyz to blocklists and deny any network traffic to its IP range, monitor for re‑registration or similar domains employing the Lido brand, and enforce strict validation of Lido‑related communications. Continuous observation of Cloudflare‑hosted IPs linked to this domain is recommended, as well as periodic re‑scanning with malware intelligence services to capture any changes in payload or hosting behavior.