lido-xp[.]com

This domain, lido-xp.com, operates as a high-risk brand impersonation scheme targeting users of the Lido cryptocurrency platform. Analysis indicates the site mimics legitimate Lido branding to deceive visitors into disclosing sensitive credentials or transferring digital assets under false pretenses. The infrastructure is designed to exploit trust in the Lido brand, potentially leading to financial loss or unauthorized access to user accounts associated with cryptocurrency transactions or staking services. Evidence supporting the malicious classification includes detection by 19 out of 95 security vendors on VirusTotal, a clear indicator of widespread recognition as a phishing threat. The domain was registered on December 17, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It appears on one security blocklist and is flagged by Google Safe Browsing for phishing activity. Additionally, the domain resolves to the IP address 151.101.1.91, hosted on AS54113 (Fastly, Inc.), and lacks an SSL certificate, further reducing its legitimacy. The page title, 'Thrillist - Adventure is always around the corner,' is inconsistent with Lido’s branding, suggesting an attempt to evade automated detection systems. Users who visited lido-xp.com should immediately revoke any permissions granted to the site within their cryptocurrency wallets or browser extensions. It is critical to review recent transactions for unauthorized activity and consider rotating credentials for any accounts accessed during the visit. If financial loss is suspected, affected parties should report the incident to relevant authorities and monitor their accounts for further suspicious behavior. Proactive measures, such as enabling multi-factor authentication and verifying domain authenticity before interaction, are strongly recommended to mitigate future risks.