lido[.]fi-main[.]at

PhishDestroy identifies the domain lido.fi-main.at as an active brand impersonation phishing campaign targeting the Lido ecosystem.

This domain is a deceptive replica of the legitimate Lido brand, registered to simulate trust and deceive users into interacting with malicious content. Data indicates it was flagged by 1 of 95 VirusTotal security vendors, resolving to IP address 176.100.42.181 via Let's Encrypt SSL. The domain was registered through Hosting Concepts B.V. / Registrar.eu (nic.at ID 648) and currently appears on 1 security blocklist. It remains accessible despite detection, with no visible takedown activity at this time.

Given the elevated risk and active status, users should avoid interacting with this domain or any linked content. Recommendations include blocking the domain at the network and endpoint levels, investigating network logs for connections to 176.100.42.181, and verifying all Lido-related communications through official, verified channels. Organizations are advised to update firewall rules and DNS blocklists to include this indicator. Exercise caution with domains resembling major DeFi or financial brands, and report suspicious domains to relevant threat intelligence platforms.