lidofinance-v2[.]com

This domain, lidofinance-v2.com, is flagged as an active brand impersonation threat targeting Lido, a staking platform. Registered on April 26, 2026, through Dynadot Inc, the domain resolves to IP 176.125.242.151, hosted by Alexhost SRL in Moldova. Infrastructure analysis reveals the use of Nginx and nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The site presents itself with the page title 'Lido Finance — Staking Platform,' directly aligning with the targeted brand. A Let's Encrypt SSL certificate (R13) is in place, which is commonly observed in both legitimate and malicious domains. The domain is currently active, returning an HTTP 200 status, and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Two of ninety-one security vendors on VirusTotal have flagged this domain as malicious. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, recent registration, and blocklist presence indicates a high-risk phishing operation. Defenders should treat this domain as malicious, block it at the network level, and monitor for related infrastructure or certificates. Further investigation into the hosting provider and nameserver patterns may reveal additional linked threats.