lido-vault[.]xyz

Analysis indicates that the domain lido-vault.xyz was registered on June 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is explicitly associated with a brand impersonation campaign targeting Lido, as indicated by the intelligence tag “Impersonates: Lido” and the scam type “Brand Impersonation.” DNS resolution points to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain uses Cloudflare’s authoritative name servers igor.ns.cloudflare.com and peaches.ns.cloudflare.com, a configuration commonly employed to hide the true hosting infrastructure. Security telemetry shows that lido-vault.xyz appears on a single security blocklist and has been flagged by PhishDestroy.

On VirusTotal, two out of ninety‑one scanners returned a detection, confirming the presence of malicious indicators. The domain carries an SSL certificate issued by Google Trust Services under the WE1 certificate profile, which provides HTTPS encryption but does not mitigate the underlying impersonation risk. A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the site. The current operational status is reported as offline, and no HTTP response data, page title, or content snapshot is available for further examination.

Consequently, the exact landing page behavior and any credential‑harvesting mechanisms remain unknown. Defenders should treat the domain as hostile: block DNS resolution to 188.114.97.3, add lido-vault.xyz to URL filtering and endpoint protection lists, and monitor for any future re‑registration or infrastructure reuse. Continuous observation of the associated IP range and Cloudflare name servers is advisable, as adversaries frequently shift hosting while retaining the same registrar and certificate authority.