votes-lidofinance[.]com

On July 22, 2026, the domain votes-lidofinance.com was identified as an elevated‑risk crypto‑scam that impersonates the Lido brand. The domain was registered on March 13, 2026 through Hello Internet Corp and resolves to the Cloudflare‑owned address 172.67.136.139, which is announced as belonging to AS13335 in the United States. Authoritative nameservers are damien.ns.cloudflare.com and dolly.ns.cloudflare.com, and the site does not present an SSL/TLS certificate, meaning HTTPS connections are not secured. The HTTP response returns the page title “Lido Liquid Staking”, directly referencing the legitimate Lido liquid‑staking service, confirming the intent to mislead users seeking staking solutions.

Network‑level analysis shows the service is protected by Cloudflare, with Cloudflare Browser Insights and HTTP/3 enabled, indicating a typical Cloudflare front‑end. The domain appears on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scanned the site and one of ninety‑four security vendors flagged it as malicious, reinforcing the suspicion of malicious activity. No further content analysis is available because the site is currently offline, and the exact payload or credential‑harvesting mechanism has not been captured.

Defenders should add votes-lidofinance.com to domain block lists, monitor DNS queries for the resolved IP, enforce TLS inspection policies to capture any future traffic, and educate users about the fake Lido staking page. Since the infrastructure uses Cloudflare, any future re‑hosting could reuse the same IP range, so watch for new subdomains pointing to 172.67.136.139. Continue to track the domain on threat‑intel feeds and update detection rules to flag the page title “Lido Liquid Staking”.