lido-finance[.]at

The domain lido-finance.at is currently active and presents the page title “Lido Finance Platform 2026 – DeFi Staking & Swap”. The title directly references the Lido brand, indicating an attempt to impersonate the legitimate Lido service. The site is classified as a seed_phish operation, targeting users who may enter private seed phrases. Infrastructure analysis shows the domain resolves to IP 104.21.52.3, which belongs to AS13335 Cloudflare, Inc. The authoritative nameservers are arushi.ns.cloudflare.com and wilson.ns.cloudflare.com. The site is served over TLS using a certificate issued by Google Trust Services under the WE1 program, and HTTP requests receive a 301 redirect response. The domain was registered on March 11, 2026 and receives a Gridinsoft trust score of 0 out of 100. Threat intelligence sources report that 4 of 95 security vendors on VirusTotal flag the domain, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in 22 separate threat pulses. The risk level is assessed as high, and the operational status remains active. Defenders should add lido-finance.at to network and DNS blocklists, monitor outbound connections to the associated IP, and enforce strict validation of any seed phrase entry points. Security teams should also update endpoint protection signatures to reflect the low Gridinsoft trust score and the observed 4/95 VirusTotal detection rate. Continuous monitoring of Cloudflare‑hosted domains that reference Lido is recommended to catch similar impersonation attempts.