lido-ffinanceset[.]webflow[.]io

The domain lido-ffinanceset.webflow.io is a confirmed phishing site engaged in brand impersonation targeting Lido, a cryptocurrency staking platform. This site posed an elevated risk as a cryptocurrency scam, attempting to deceive users into interacting with fraudulent financial services. No drainer kit was detected, and the site is currently taken offline, rendering it inactive.

Technical indicators confirm the domain's malicious nature. As of analysis, 2 of 95 VirusTotal security vendors flagged lido-ffinanceset.webflow.io, while it appeared on 1 security blocklist (PhishDestroy). The domain was registered through MarkMonitor, Inc. on May 8, 2013, though the phishing content was hosted more recently. It resolved to the IP address 104.18.36.248, located in the US under Cloudflare's AS13335, and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was '404 - Page not found,' and the site employed Cloudflare and HTTP/3 technologies. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with lido-ffinanceset.webflow.io should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the phishing domain to the impersonated brand (Lido) via their official security channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.