lidofinance[.]us

Analysis of lidofinance.us, registered through Web Commerce Communications Limited on 08 May 2025, shows a clear pattern of brand impersonation targeting Lido. The domain resolves to the Cloudflare address 104.21.46.231, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). No TLS certificate was observed, indicating the site was served over plain HTTP. The page title returned by the server matches the legitimate Lido website (“Lido Finance: Secure Ethereum Staking & Liquid Staking Solutions | Lido.fi”), suggesting an attempt to masquerade as an official Lido landing page.

Google Safe Browsing classifies the site as social engineering, and VirusTotal reports 15 of 95 antivirus engines flagging the domain as malicious, reinforcing the suspicion of a crypto‑related scam. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. Additional reputation data includes a Gridinsoft trust score of 0 / 100 and the presence of the Cloudflare nameservers addilyn.ns.cloudflare.com and cris.ns.cloudflare.com. The overall threat is catalogued as a “Crypto Scam” with the specific impersonation of Lido.

As of the report date (23 July 2026) the site is marked offline, but the infrastructure—namely the Cloudflare‑protected IP and the registered domain—remains under the control of the threat actor and could be re‑activated. Defenders should continue to block lidofinance.us at perimeter devices, add the domain to URL filtering and email security policies, and monitor the associated IP 104.21.46.231 for any future activity. Threat‑intel sharing platforms should be updated with the observed indicators, including the registrar, creation date, nameservers, and the lack of SSL, to improve detection of similar brand‑impersonation campaigns.