lieo[.]fi

This domain, lieo.fi, is an active phishing site designed to impersonate Google’s login interface. The site mimics Google’s branding and page title to deceive users into entering their credentials, which are then harvested by threat actors. Such attacks are commonly used to gain unauthorized access to email accounts, cloud storage, or other linked services, leading to data breaches or further malicious activity like business email compromise. Analysis indicates lieo.fi was registered on May 26, 2026, through Key-Systems GmbH, a registrar often exploited for malicious domains. The domain resolves to the IP address 142.251.150.119, hosted on Cloudflare’s network (AS13335), which is frequently abused to obscure the true origin of phishing infrastructure. Security vendors have flagged the domain, with 3 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the site appears on three security blocklists, further confirming its association with phishing campaigns. If you visited lieo.fi or entered credentials on the site, immediate action is required. First, change the password for the affected Google account and any other services where the same credentials were reused. Enable multi-factor authentication (MFA) to add an extra layer of security. Monitor the account for unauthorized access or suspicious activity, such as unfamiliar logins or sent emails. If financial or sensitive data was exposed, consider reporting the incident to relevant authorities or cybersecurity response teams for further guidance.