lido-stakings[.]webflow[.]io

PhishDestroy has identified a high-risk phishing domain, lido-stakings.webflow.io, which impersonates the Lido brand to steal user credentials and sensitive information. This threat is classified as brand impersonation, specifically targeting Lido stakeholders. The domain was hosted on Cloudflare's infrastructure and leveraged a fraudulent Webflow subdomain to appear legitimate.

Technical indicators reveal that the domain was flagged by 10 out of 95 security vendors on VirusTotal, with Google Safe Browsing also marking it as phishing. It was registered through MarkMonitor, Inc. on May 08, 2013, and resolved to IP address 2606:4700:440c::ac40:9708. The SSL certificate was issued by Google Trust Services (WE1), and the page displayed a 404 error, suggesting the phishing content may have been taken down or hidden. The domain appeared on one security blocklist.

As of the latest check, the domain is offline, indicating that hosting providers or authorities have taken action to neutralize the threat. However, users should remain vigilant as similar domains may reappear. PhishDestroy recommends avoiding any interaction with this domain, not entering any personal or financial information, and reporting any suspicious emails or links to the relevant security teams. Users who may have engaged with the site should change their Lido-related passwords immediately and enable two-factor authentication.