# leocopilot.online — SUSPICIOUS

> PhishDestroy identifies leocopilot.online as a credential theft domain mimicking LeoFinance. VirusTotal shows 0/95 detections. Avoid clicking links.

## Summary
PhishDestroy assesses leocopilot.online as an ACTIVE credential theft domain posing as LeoFinance services. This domain is under investigation but remains accessible, with no detections from VirusTotal (0/95) and a recently created SSL certificate via Let’s Encrypt.  

This domain was flagged with a creation date of March 23, 2026, resolving to IP 104.21.86.22 through HOSTINGER operations, UAB. To date, it has not been listed on any major blocklists, and its trust score remains uncompromised due to its infancy. The absence of detections on VirusTotal suggests either a newly deployed campaign or evasion tactics currently bypassing AV engines.  

As a credential theft domain impersonating LeoFinance, users should avoid interacting with this domain. Block the domain at the DNS level, flag the IP 104.21.86.22 for inspection, and warn users about potential phishing emails or social media links promoting 'LeoCopilot.' Deploy browser extensions that detect credential harvesting forms and enforce MFA on all LeoFinance accounts. Report the domain to abuse channels for takedown and monitor internal logs for unusual authentication attempts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-23 21:14:11
- Registrar: HOSTINGER operations, UAB
- IP: 104.21.86.22

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/efb1ab84-2e10-4f88-b6ce-ec3fa82db3ca
- PhishDestroy: https://phishdestroy.io/domain/leocopilot.online/
- LLM endpoint: https://phishdestroy.io/domain/leocopilot.online/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/leocopilot.online/
Last updated: 2026-03-24