leoguard-live[.]pages[.]dev

This domain, leoguard-live.pages.dev, operates as a phishing site designed to mimic Cloudflare security alerts, likely targeting users with fake login portals to harvest credentials. The page title explicitly reads 'Suspected phishing site | Cloudflare,' which may be used to deceive users into believing the page is a legitimate security warning or authentication prompt. Such tactics are commonly employed to trick victims into entering sensitive information, which can then be exploited for unauthorized access or further social engineering attacks. Analysis indicates the domain was registered through Cloudflare, Inc. on April 02, 2026, and currently resolves to the IP address 172.66.47.155. It appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently abused by threat actors to lend false credibility to malicious sites. The domain has been taken offline, but its infrastructure remains a documented indicator of compromise. Users who visited leoguard-live.pages.dev should immediately revoke any credentials entered on the site, particularly if they correspond to sensitive accounts such as email, financial services, or corporate logins. Monitor associated accounts for unauthorized activity and enable multi-factor authentication where available. If financial or personally identifiable information was submitted, consider reporting the incident to relevant authorities and credit monitoring services. Security teams should update blocklists to include this domain and its resolved IP address as part of phishing mitigation strategies.