yolidomu[.]pages[.]dev

Analysis of yolidomu.pages.dev shows a short‑lived domain created on July 12, 2025 that was used to impersonate the Lido brand in a crypto‑focused scam. The site presented the page title "Phio News Daily" and returned an HTTP 403 status, indicating that direct content retrieval was blocked at the time of analysis. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.46.214, which belongs to AS13335 (Cloudflare) and is geolocated in the United States. TLS termination is provided by a Google Trust Services certificate (WE1), and the host advertises HSTS and HTTP/3 support, typical of Cloudflare‑protected services. Three of ninety‑five VirusTotal scanners flagged the domain, confirming that a minority of security engines recognize it as malicious.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, indicating that threat‑intel feeds have already taken mitigation steps. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low credibility of the site. Nameservers listed include andy.ns.cloudflare.com, maxine.ns.cloudflare.com, ns.cloudflare.com, and ns2.cloudflare, all consistent with the Cloudflare hosting environment. The current status is offline, but the infrastructure footprint (IP, SSL, and nameserver configuration) remains observable and could be reused for future campaigns.

Defenders should continue to block the domain and its associated IP address at perimeter and DNS filtering layers, monitor Cloudflare‑owned IP ranges for similar activity, and update internal blacklists with the observed indicators. Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection rates.