v2lido[.]finance

On 23 July 2026, the domain v2lido.finance was observed as offline. The domain was registered on 21 February 2026 and presents the page title “www.www.v2lido.finance”. VirusTotal records indicate that 7 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on a single public blocklist, PhishDestroy. The site is classified as a crypto‑scam and explicitly claims to impersonate the Lido brand.

The limited detection footprint suggests a short‑lived campaign that was taken down shortly after deployment. No additional infrastructure details such as IP address, hosting provider, ASN, or SSL certificate information are available in the current intelligence set, leaving the underlying hosting environment unverified. The presence of a duplicated “www” prefix in the page title may be an attempt to obscure the true URL, but the title itself does not provide further insight into the content served.

Defenders should continue to monitor for any re‑registration of the domain or related variants, update internal blocklists with the observed indicator, and ensure that endpoint and email filters reference the VirusTotal detection count. Because the domain is already offline, active takedown actions are no longer required, but threat‑intel sharing with partner organizations is recommended to flag the Lido impersonation pattern for future detection. The current evidence base is limited to registration metadata, detection counts, and the blocklist entry; additional analysis of hosting infrastructure, TLS usage, and traffic patterns would be needed to fully characterize the campaign’s scope.